AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-73659

HIGH · CVSS 8.1 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The vulnerability affects the Trigger.dev platform, specifically versions 4.4.2 to 4.5.0, allowing attackers to exploit caller-controlled filenames to perform directory traversal. This can lead to unauthorized access or modification of another organization's task payloads and outputs in multi-organization self-hosted environments. Organizations using affected versions should prioritize upgrading to version 4.5.0 to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-73659
Severity
HIGH
CVSS
8.1
EPSS
0.34%

Original NVD Description

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.