CVE-2026-114083 Details
Description
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
A path traversal vulnerability has been identified in Trigger.dev versions prior to 4.5.0-rc.3. This vulnerability exists in the api/v1/packets and api/v2/packets endpoints, allowing authenticated tenants to escape their object key prefix by exploiting an unsanitized filename splat segment. Attackers with a valid API key can inject ../ sequences to access presigned GET or PUT URLs, enabling them to read or overwrite other tenants' run payloads and outputs.
Users should update to Trigger.dev version 4.5.0-rc.5 or later, where this vulnerability has been fixed. For those using the self-hosted version, ensure that the object store is properly configured to reject path traversal attempts and that per-object authorization checks are in place.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-rc.3-path-traversal-via-packets-presigned-url-endpoints | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Trigger.dev | <= 4.4.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |