6

CVE-2026-53449

Exploit

Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Coturn Project ≫ Coturn Version < 4.13.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.159
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6 0.8 5.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r
Third Party Advisory
Exploit
https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55
Patch
https://github.com/coturn/coturn/releases/tag/4.13.0
Release Notes