CVE-2026-53449 Details
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.
An arbitrary file overwrite vulnerability has been identified in Coturn versions prior to 4.13.0. The issue arises in the 'psd' (print sessions dump) command, which accepts a filename argument and passes it to 'fopen' without any path validation. This flaw allows an authenticated admin with CLI access to overwrite any file that is writable by the Coturn process. The vulnerability can be exploited by sending a crafted filename through the 'psd' command, which is then used to truncate and replace the contents of the targeted file with session dump data.
Users can upgrade to Coturn version 4.13.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55 | [email protected] | Patch |
| https://github.com/coturn/coturn/releases/tag/4.13.0 | [email protected] | Release Notes |
| https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coturn project coturn | < 4.13.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |