CVE-2026-114398: Unrestricted Upload of File with Dangerous Type in polonel trudesk

CVE-2026-114398 describes an unrestricted file upload vulnerability in Trudesk through version 1.2.11. Authenticated users can upload files with dangerous types such as HTML or SVG via the uploadlogo, uploadpagelogo, and uploadfavicon endpoints. By spoofing image MIME types, attackers can place script-bearing files in the publicly accessible /assets/ directory. These files are served without authentication, enabling stored cross-site scripting attacks and unauthorized modification of the application's branding.

The vulnerability allows attackers with authenticated access to upload malicious files that can execute scripts in the context of the application. This can lead to stored cross-site scripting, potentially compromising user sessions or performing unauthorized actions. Additionally, attackers can replace instance branding, which may be used for phishing or social engineering within the application environment.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to upload files and monitor uploads for suspicious file types. Consider disabling or restricting the vulnerable upload endpoints if possible.