CVE-2026-53449

Published: Jul 10, 2026Modified: Jul 16, 2026

6.0

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Exploitability: 0.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.

Affected (1)

Products: Coturn Project: Coturn

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Coturn Project Coturn	Before 4.13.0

Related CWEs

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (4)

https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55

Source: security-advisories@github.com

Patch

https://github.com/coturn/coturn/releases/tag/4.13.0

Source: security-advisories@github.com

Release Notes

https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.