high8.1
CVE-2026-114083
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to e…
Impact
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
Affected products
| Product | Affected versions |
|---|---|
| Trigger.Dev | before 4.5.0-rc.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.