CVE-2026-73659
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Trigger.dev from version 4.4.2 to 4.5.0 has a vulnerability in packet presign routes where a caller-controlled filename is passed to generate presigned URLs, allowing directory traversal to escape the object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads on multi-organization self-hosted instances.
Risk Assessment
Risk of unauthorized access to other organizations' data, potentially leading to data leakage or manipulation of task payloads.
Recommendation
Update Trigger.dev to version 4.5.0 or later, which includes the fix.
Original NVD description (English source)
Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.