CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command
An authenticated admin can overwrite arbitrary files via the CLI psd command due to lack of path validation, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53449?
CVE-2026-53449 is a medium-severity path traversal vulnerability in coturn, published on 10 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.
Weakness: CWE-73
Which versions are affected by CVE-2026-53449?
It affects 1 product.
Products include Coturn Project Coturn.
How do I fix CVE-2026-53449?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53449 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53449 exists.
Other vulnerabilities in coturn
- CVE-2018-4056 SQL injection in coTURN
- CVE-2026-43994 Coturn: Stack buffer overflow in decode_oauth_token_gcm()
- CVE-2018-4058 Server-side request forgery in coTURN
- CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
- CVE-2026-53450 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
Sources
Also known as DEBIAN-CVE-2026-53449, GHSA-jj76-vwjw-w34r, UBUNTU-CVE-2026-53449.