CVE-2026-78435
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can delete arbitrary files on the server, potentially leading to data loss, system corruption, or application compromise.
Recommendation
Update Faveo Helpdesk to a version newer than 2.0.3 if available, and monitor the system for unauthorized changes.
Other vulnerabilities in Faveo Helpdesk
See all- CVE-2026-72554Medium
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling access to arbitrary ticket threads including internal agent notes.
- CVE-2026-78434Medium
Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.