Trudesk versions up to 1.2.11 allow any authenticated user to upload HTML or SVG files as logos, page logos, or favicons. The application accepts these files without validating MIME type, allowing an attacker to store script‑bearing content in the public webroot. This flaw is an instance of CWE‑434 (Unrestricted Upload of File With Dangerous Type). When an unauthenticated user loads the injected file from /assets/, the browser executes the script, leading to stored cross‑site scripting and the ability to replace instance branding. The vulnerability therefore exposes all authenticated users to arbitrary script execution and potential data exfiltration while also permitting an attacker to modify the visual identity of the application, which could erode trust and facilitate phishing implicitly.

The vulnerability affects Trudesk 1.2.11 and earlier releases of the Trudesk project. Administrators should verify whether their deployment runs any of these affected versions and plan for remediation accordingly.

The CVSS base score of 5.1 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is only authenticated access, but once logged in, the attacker can upload malicious files and any unauthenticated user visiting the site will be exposed to the stored XSS. The risk is therefore moderate; the lack of an EPSS score suggests exploitation is not yet widespread, yet the possibility of widespread browser-based impact warrants patching as soon as possible.