Trudesk versions up to 1.2.11 contain a path traversal and authorization bypass flaw in the profile image upload handler that lets an authenticated user supply crafted _id and username values to overwrite other users’ avatars or upload PNG, JPG, JPEG, or GIF files outside the intended public/uploads/users directory. The vulnerability is a classic input validation error (CWE‑22) that permits the attacker to write files to arbitrary locations by using directory‑traversal sequences such as /../../../x, thereby undermining file system integrity and enabling possible defacement or injection of malicious media.

The affected application is polonel’s Trudesk, a ticketing and collaboration platform. All releases up through version 1.2.11 are vulnerable; no later releases are specified in the data. The flaw is exploitable on any host configuration that allows authenticated users to submit avatar uploads, including shared or external hosting environments.

With a CVSS score of 5.3 the vulnerability has moderate severity. Exploitation requires an active user account that can reach the image‑upload endpoint; the attack remains local to the application rather than to the underlying operating system. Because EPSS data is not available and the flaw is not listed in the CISA KEV catalog, the potential for real‑world exploitation is uncertain but non‑negligible. Organizations should consider the risk high where user profiles are visible or critical, as an attacker could deface accounts or place arbitrary image files on the server.