UBUNTU-CVE-2026-53449
Coturn versions prior to 4.13.0 contain a vulnerability in the 'psd print sessions dump' CLI command that allows an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process. This occurs because the filename argument is passed directly to fopen without path validation, enabling file truncation and overwrite with session dump data. The issue is fixed in version 4.13.0.
AI Analysis
Technical Summary
Coturn, an open source TURN and STUN server, has a vulnerability in versions prior to 4.13.0 where the 'psd print sessions dump' CLI command accepts a filename argument that is used directly in a file open operation without validating the path. An authenticated administrator with CLI access can exploit this to overwrite arbitrary files writable by the coturn process, potentially leading to integrity and availability impacts. The vulnerability is addressed in coturn version 4.13.0.
Potential Impact
An authenticated administrator with CLI access can overwrite arbitrary files writable by the coturn process, which can lead to denial of service or unauthorized modification of files. The vulnerability does not impact confidentiality but affects integrity and availability.
Mitigation Recommendations
This vulnerability is fixed in coturn version 4.13.0. Users should upgrade to version 4.13.0 or later to remediate this issue. No other mitigation or temporary fix is indicated.
UBUNTU-CVE-2026-53449
Description
Coturn versions prior to 4.13.0 contain a vulnerability in the 'psd print sessions dump' CLI command that allows an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process. This occurs because the filename argument is passed directly to fopen without path validation, enabling file truncation and overwrite with session dump data. The issue is fixed in version 4.13.0.
CVSS v3.1
Score 6.0medium
Affected software
pkg:deb/ubuntu/[email protected]?arch=source&distro=xenialpkg:deb/ubuntu/[email protected]?arch=source&distro=bionicpkg:deb/ubuntu/[email protected]?arch=source&distro=focalpkg:deb/ubuntu/[email protected]~ubuntu22.04.1?arch=source&distro=jammypkg:deb/ubuntu/[email protected]?arch=source&distro=noblepkg:deb/ubuntu/[email protected]?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Coturn, an open source TURN and STUN server, has a vulnerability in versions prior to 4.13.0 where the 'psd print sessions dump' CLI command accepts a filename argument that is used directly in a file open operation without validating the path. An authenticated administrator with CLI access can exploit this to overwrite arbitrary files writable by the coturn process, potentially leading to integrity and availability impacts. The vulnerability is addressed in coturn version 4.13.0.
Potential Impact
An authenticated administrator with CLI access can overwrite arbitrary files writable by the coturn process, which can lead to denial of service or unauthorized modification of files. The vulnerability does not impact confidentiality but affects integrity and availability.
Mitigation Recommendations
This vulnerability is fixed in coturn version 4.13.0. Users should upgrade to version 4.13.0 or later to remediate this issue. No other mitigation or temporary fix is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-53449
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b47c68715ace43d9e9ea
Added to database: 07/16/2026, 10:37:48 UTC
Last enriched: 07/16/2026, 11:54:54 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.