The vulnerability originates from the packet presign API in Trigger.dev's webapp routes. An attacker with a bound project API key can submit a crafted filename containing .. segments, which the server passes unchecked to the object store URL generation functions. This allows the attacker to generate presigned URLs that target paths outside the intended packets/<projectRef>/<env>/ prefix, effectively granting read or write access to object store files belonging to other projects or organizations. The flaw is a path traversal defect (CWE‑22) that directly compromises confidentiality and integrity of data stored in multi‑tenant self‑hosted deployments.

The issue affects the open‑source Trigger.dev platform for AI workflows. All releases from version 4.4.2 through, but not including, version 4.5.0 are vulnerable on self‑hosted multi‑tenant installations. Version 4.5.0 and later include the fix that sanitizes the filename before generating presigned URLs.

The CVSS score of 8.1 indicates high severity, and the exploitability is considered feasible because an attacker only needs authenticated access to the packet presign endpoint, which is normally available to all users with a project API key. The EPSS score is not available, yet the absence of a KEV listing suggests no publicly known exploitation yet. Despite that, the potential for confidential data leaks or data tampering across tenants warrants immediate action. The attack vector is via the documented API, so remediation should focus on patching and key management.