Trudesk versions up to 1.2.11 contain a path traversal flaw that permits an administrator to delete arbitrary files by supplying encoded traversal sequences to the DELETE /api/v1/backup/:backup endpoint. The DELETE operation can remove any file on the server, including configuration, database and system files, while the POST /api/v1/backup/restore endpoint can extract archives or restore backups to paths outside the intended directory hierarchy. This flaw is a classic CWE‑22 path‑traversal weakness, allowing destructive file removal or placement of malicious files, thereby undermining confidentiality, integrity and availability.

Trudesk, developed by polonel and hosted under the Trudesk project, is affected in all releases up to and including version 1.2.11. The vulnerability exists in the backup delete and restore APIs exposed through the Trudesk web application. Administrators of any instance that runs a susceptible version can potentially exploit the flaw.

The CVSS score of 7 denotes a high severity for this vulnerability. Although no EPSS score is available and the flaw is not listed in the CISA KEV catalog, the high score reflects a dangerous path traversal issue that requires an authenticated administrator or anyone who can reach the protected API. An attacker with such privileges can delete critical configuration or database files, or extract backup archives to arbitrary locations, which can lead to loss of data, system compromise or further persistence. With no publicly known exploits yet, the risk remains primarily theoretical, but the potential impact warrants immediate addressing.