HIGH 8.6 NVD
CVE-2026-114083
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to es
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-rc.3-path-traversal-via-pack
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.