CVE-2026-114402: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in polonel trudesk

CVE-2026-114402 describes a path traversal and authorization bypass vulnerability in polonel's Trudesk product, specifically in the accountsController.uploadImage method. This flaw allows authenticated users to overwrite avatar images of other users by manipulating form-supplied _id and username parameters. The vulnerability circumvents the incomplete sanitization implemented for CVE-2022-1752 by using path traversal sequences (e.g., /../../../x), enabling the attacker to write png, jpg, jpeg, or gif files outside the designated public/uploads/users directory.

An authenticated user can overwrite arbitrary avatar image files of other users, potentially leading to unauthorized modification of user profile images. This could be used to deface profiles or cause confusion but does not directly indicate further privilege escalation or data disclosure based on the provided information.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the uploadImage functionality to trusted users only and monitor for suspicious file upload activity.