EUVD-2026-107249

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

CVE-2026-114402

The Trudesk application (versions through 1.2.11 ) is vulnerable to a path traversal and authorization bypass within the accountsController.uploadImage function. This flaw allows authenticated users to overwrite other users' avatars by manipulating form-supplied _id and username fields. Specifica...