# CVE-2026-114083: Trigger.dev path traversal in packet endpoints

Source: https://junglewise.ai/threats/cve-2026-114083-trigger-dev-before-4-5-0-rc-3-contains-a-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114083 · Severity: high · CVSS 8.1 · Published 2026-10-21

Trigger.dev is a task execution and workflow platform that stores large payloads in cloud object storage and uses presigned URLs to let SDKs and workers access them. An authenticated attacker with any valid API key can exploit unsanitized filename parameters in the packet endpoints to traverse directories, obtaining presigned URLs that grant read and write access to other tenants' stored payloads and outputs—which commonly contain secrets, credentials, and personally identifiable information.

Technologies: [Trigger.dev](https://junglewise.ai/threats/technologies/trigger-dev). Vendors: [Trigger.dev](https://junglewise.ai/threats/vendors/trigger-dev).

## Quick answers

**Is CVE-2026-114083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114083 being exploited in the wild.

**How severe is CVE-2026-114083?** High severity, with a CVSS score of 8.1, published 21 October 2026.

**Which products and versions are affected?** Trigger.dev before 4.5.0-rc.3.

**Is there a fix for CVE-2026-114083?** Yes: fixed in 4.5.0-rc.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114083 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-114083?** Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.0-rc.3

## Technical details

The vulnerability is a path traversal flaw in the api/v1/packets and api/v2/packets endpoints (apps/webapp/app/routes/api.v1.packets.$.ts and api.v2.packets.$.ts) where the filename splat parameter is passed directly to generatePresignedUrl() without sanitization of ../ sequences. The presigned URL is constructed by concatenating packets/${projectRef}/${envSlug}/${filename} and then URL-encoding it; the WHATWG URL parser normalizes ../ segments before the aws4fetch client signs the request, allowing an attacker to resolve the key outside their own environment's prefix into any other tenant's directory. The vulnerable configuration is the default self-hosted deployment using static object store credentials (MinIO), which normalizes traversal patterns; AWS SDK backend deployments percent-encode dots and are less affected. Requires one valid secret API key for any environment the attacker controls.

## Affected products

- Trigger.dev Trigger.dev before 4.5.0-rc.3

## Timeline

- 2026-07-09: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp)
- [https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-rc.3-path-traversal-via-packets-presigned-url-endpoints](https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-rc.3-path-traversal-via-packets-presigned-url-endpoints)

## Related threats

- [Trigger.dev cross-site request forgery in logout endpoint](https://junglewise.ai/threats/cve-2026-114093-trigger-dev-before-4-5-6-contains-a-cross-site-request-forgery)
- [Trigger.dev missing authentication in task run replay](https://junglewise.ai/threats/cve-2026-114092-trigger-dev-before-4-5-0-performs-no-authentication-or)
- [Trigger.dev cross-tenant authorization bypass in run replay](https://junglewise.ai/threats/cve-2026-114091-trigger-dev-before-4-5-0-looks-up-runs-by-friendlyid-alone-in)
- [Trigger.dev cross-site request forgery in CLI authorization flow](https://junglewise.ai/threats/cve-2026-114089-trigger-dev-before-4-5-2-contains-a-cross-site-request-forgery)
- [Trigger.dev hardcoded default secret authentication bypass in Socket.IO](https://junglewise.ai/threats/cve-2026-114088-trigger-dev-before-4-5-4-contains-a-hardcoded-default-secret)