CVE-2026-114398 Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

What is CVE-2026-114398?

CVE-2026-114398 is a medium-severity vulnerability in polonel trudesk, published on 21 Oct 2026.

Official description

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

Weakness: CWE-434

Which versions are affected by CVE-2026-114398?

It affects 1 product.

Products include Trudesk Project Trudesk.

How do I fix CVE-2026-114398?

No fix has been published for CVE-2026-114398 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114398 being exploited?

There is no known exploitation of CVE-2026-114398 in the wild and no public exploit code.

Other vulnerabilities in polonel trudesk

• CVE-2022-2023 Incorrect Use of Privileged APIs in polonel/trudesk Critical 10.0
• CVE-2022-1770 Improper Privilege Management in polonel/trudesk Critical 9.9
• CVE-2022-2128 Unrestricted Upload of File with Dangerous Type in polonel/trudesk Critical 9.6
• CVE-2022-1931 Incorrect Synchronization in polonel/trudesk Critical 9.1
• CVE-2022-1947 Use of Incorrect Operator in polonel/trudesk Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3469-653g-542x.