CVE-2026-114399: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in polonel trudesk
Description
Trudesk versions up to and including 1.2.11 have a path traversal vulnerability that allows administrators to delete arbitrary files or restore archives to unintended locations by manipulating API requests with crafted path inputs. This flaw affects the DELETE /api/v1/backup/:backup and POST /api/v1/backup/restore endpoints. The vulnerability has a high severity rating with a CVSS score of 7. No patch or remediation information is provided in the available data.
CVSS v4.0
Score 7.0high
Affected software
polonel
trudesk
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-114399 describes a path traversal vulnerability in polonel's Trudesk software up to version 1.2.11. The vulnerability permits administrators to delete arbitrary files by sending encoded traversal sequences to the DELETE /api/v1/backup/:backup endpoint. Additionally, attackers can supply unvalidated file paths to the POST /api/v1/backup/restore endpoint to restore or extract archives outside the intended directory boundaries. This improper limitation of pathname access can lead to unauthorized file system modifications.
Potential Impact
Successful exploitation allows an attacker with administrator privileges to delete arbitrary files on the system or restore backup archives to arbitrary file system locations outside the intended directories. This can lead to data loss, system instability, or unauthorized file modifications. The vulnerability requires administrator privileges, limiting the attack surface to privileged users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious use of the affected API endpoints. Avoid exposing the backup and restore APIs to untrusted networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-21T11:46:44.482Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad8b86d2cdf04f656f0cacb
Added to database: 10/21/2026, 13:04:45 UTC
Last enriched: 10/21/2026, 13:16:23 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.