vulnwire
3.8low

CVE-2026-78435

Faveo Helpdesk Logo SettingsController.php unlink path traversal

Published 2 mo ago · modified 27 d ago · JSON

CVSS
3.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 44%
Public exploits
0
none known

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction (EPSS)

0.51% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA3.13.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
CNA3.03.8CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
CNA2.04.7AV:N/AC:L/Au:M/C:N/I:P/A:P/E:POC/RL:ND/RC:UR
CNA4.02.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.13.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CNA2.04.7AV:N/AC:L/Au:M/C:N/I:P/A:P

Affected products

  • Faveo Helpdesk

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • vuldb.com /vuln/394713 · vdb-entry, technical-description
  • vuldb.com /vuln/394713/cti · signature, permissions-required
  • vuldb.com /cve/CVE-2026-78435 · third-party-advisory
  • vuldb.com /submit/886395 · third-party-advisory
  • github.com /faveosuite/faveo-helpdesk/issues/8343 · exploit, issue-tracking

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.