CVE-2026-114083— Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
Quick assessment
Affected
triggerdotdev trigger.dev
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 4.5.0-rc.3 之前的 Trigger.dev 版本中， 和 接口存在路径遍历漏洞。该漏洞允许已认证的租户通过未过滤的文件名通配符片段（splat segment），绕过其对象键前缀（object key prefix）。持有任一有效 API 密钥的攻击者可通过提交 序列，获取预签名的 GET 或 PUT URL，从而读取或覆盖其他租户的运行负载（run payloads）和输出数据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114083
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| triggerdotdev | trigger.dev | 0 ~ 4.5.0-rc.3 | - |
|
II. Public POCs for CVE-2026-114083
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114083
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114083 (2)
Same Patch Batch · triggerdotdev · 2026-10-21 · 28 CVEs total
| CVE-2026-114089 | 8.8 HIGH | Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover |
| CVE-2026-114068 | 8.3 HIGH | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint |
| CVE-2026-114069 | 8.1 HIGH | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint |
| CVE-2026-114078 | 8.1 HIGH | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Look |
| CVE-2026-114087 | 8.1 HIGH | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets |
| CVE-2026-114082 | 8.1 HIGH | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials |
| CVE-2026-114066 | 8.1 HIGH | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints |
| CVE-2026-114085 | 7.9 HIGH | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API |
| CVE-2026-114081 | 7.7 HIGH | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name |
| CVE-2026-114084 | 7.7 HIGH | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API |
| CVE-2026-114077 | 7.1 HIGH | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWork |
| CVE-2026-114065 | 6.5 MEDIUM | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders |
| CVE-2026-114088 | 6.5 MEDIUM | Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO |
| CVE-2026-114092 | 6.5 MEDIUM | Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action |
| CVE-2026-114067 | 6.5 MEDIUM | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route |
| CVE-2026-114073 | 5.5 MEDIUM | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs |
| CVE-2026-114079 | 5.4 MEDIUM | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint |
| CVE-2026-114075 | 5.4 MEDIUM | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API |
| CVE-2026-114076 | 5.4 MEDIUM | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL |
| CVE-2026-114074 | 5.4 MEDIUM | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: trigger.dev
-
CVE-2026-114093
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /log -
CVE-2026-114092
Trigger.dev before 4.5.0 Missing Authentication in Dashboard -
CVE-2026-114091
Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure -
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to P -
CVE-2026-114088
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authen
Same vendor: triggerdotdev
-
CVE-2026-114093
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /log -
CVE-2026-114092
Trigger.dev before 4.5.0 Missing Authentication in Dashboard -
CVE-2026-114091
Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure -
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to P -
CVE-2026-114088
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authen
Same weakness: CWE-22
-
CVE-2026-111833
WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion -
CVE-2026-114402
Trudesk through 1.2.11 Path Traversal and Authorization Bypa -
CVE-2026-114399
Trudesk through 1.2.11 Path Traversal via Backup Delete and -
CVE-2026-114040
DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelMa -
CVE-2026-113743
Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_
V. Comments for CVE-2026-114083
No comments yet