Path Traversal Vulnerability in Faveo Helpdesk Disclosed

cvefeed.io

Path Traversal Vulnerability in Faveo Helpdesk Disclosed

First seen 26 Aug 2026, 07:53 UTC • •57.1

Article Content

1 / 5

Browse articles

ThreatCluster •August 27, 2026 at 06:40 UTC

•CVE-2026-78435 affects Faveo Helpdesk versions up to 2.0.3.
•The vulnerability allows remote path traversal attacks via the unlink function.
•A patch was released on August 25, 2026, following public disclosure.

A path traversal vulnerability (CVE-2026-78435) has been identified in Faveo Helpdesk versions up to 2.0.3, affecting the unlink function in app/Http/Controllers/Admin/helpdesk/SettingsController.php. This vulnerability allows remote attackers to manipulate the data1 parameter, potentially deleting or modifying files outside the intended directory. The issue was reported to the project on August 24, 2026, but no response has been received from the maintainers. Although a patch was released on August 25, 2026, there is currently no evidence of public proof-of-concept exploits or active exploitation in the wild. Security professionals are advised to upgrade to versions beyond 2.0.3 and implement strict input validation. The CVSS score for this vulnerability is 4.0, indicating a medium severity level. The vulnerability has been disclosed publicly, raising concerns about its potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-08-24

CVE-2026-78435 published

The vulnerability was disclosed, affecting Faveo Helpdesk up to version 2.0.3.

cve.threatint.com

2026-08-25

Patch released

A patch for the vulnerability was made available on GitHub Advisory.

2026-08-26

Public awareness raised

Multiple outlets reported on the vulnerability, emphasizing the need for immediate action.

More articles in this cluster (4)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Vulnerability (2)

CVE-2026-78435
Path Traversal

Weakness (1)

CWE-22 - Path Traversal

Affected Platform (1)

Faveo Helpdesk

Relationships

CVE-2026-78435 targets Faveo Helpdesk
Path Traversal targets Faveo Helpdesk
CVE-2026-78435 related to CWE-22 - Path Traversal

Following this threat?

Track CVE-2026-78435 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WordPress Vulnerability CVE-2026-87902 Exploited Within Hours of Disclosure On September 22, 2026, WordPress released version 7.1.2 to address a critical vulnerability, CVE-2026-87902, which allows unauthenticated attackers to exploit a path traversal flaw in the page-template resolution process. This vulnerability, which affects WordPress versions 4.7.0 through 7.1.1, has a CVSS score of…

Path Traversal Vulnerability in WinRAR Exploited by RomCom Group CVE-2025-8088 is a path traversal vulnerability in WinRAR versions up to 7.12, allowing attackers to exploit alternate data streams (ADSes) in RAR files to extract malicious payloads to sensitive system locations. Exploitation began in the wild on July 18, 2025, with attackers linked to the Russia-aligned RomCom…