The vulnerability is a path traversal flaw in Trigger.dev’s api/v1/packets and api/v2/packets endpoints. An authenticated tenant can insert ../ sequences into the filename splat segment when requesting a presigned URL, thereby escaping the intended object key prefix. The generated GET or PUT presigned URLs can then be used to read or overwrite other tenants’ run payloads and outputs, effectively compromising data integrity and confidentiality.

Trigger.dev versions prior to 4.5.0‑rc.3 are affected. The vendor product is Trigger.dev's packet management service, and any deployment using a version older than 4.5.0‑rc.3 exposes the flaw.

The flaw carries a CVSS score of 8.6, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low but non-zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must possess a valid API key; the path traversal is performed through authenticated API calls, so compromise is tied to tenant credentials. Once a malicious tenant obtains a presigned URL for another tenant’s data, they can read or modify that data, enabling data exfiltration or tampering.