Is CVE-2026-73659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73659 being exploited in the wild.

How severe is CVE-2026-73659?

High severity, with a CVSS score of 8.1, published 13 August 2026.

Is there a fix for CVE-2026-73659?

A patch was published on 2026-06-05: Fix merged in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73659 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73659?

Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73659: Trigger.dev path traversal in packet presign routes

CVE-2026-73659 · Severity: high · CVSS 8.1 · Published 2026-08-13

Trigger.dev is an open-source platform for building AI workflows in TypeScript. A path traversal vulnerability in the packet presign API allows a project API key to escape the intended storage directory and read or overwrite task payloads and outputs belonging to other organizations on multi-organization self-hosted instances. This could lead to unauthorized data access, manipulation of workflow data, or disruption of other organizations' operations.

Technologies: Trigger.dev. Vendors: Trigger.dev.

Quick answers

Is CVE-2026-73659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73659 being exploited in the wild.
How severe is CVE-2026-73659?: High severity, with a CVSS score of 8.1, published 13 August 2026.
Which products and versions are affected?: Trigger.dev 4.4.2 to 4.5.0.
Is there a fix for CVE-2026-73659?: A patch was published on 2026-06-05: Fix merged in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73659 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73659?: Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw in the packet presign routes (apps/webapp/app/routes/api.v1.packets.$.ts) that passes a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest without proper validation. An attacker with a project API key can craft paths containing ".." traversal segments to escape the intended packets/<projectRef>/<env>/ object-store prefix and access resources outside their project's scope. The flaw affects versions 4.4.2 through 4.5.0 and is remedied by strict path validation that rejects traversal segments, leading slashes, backslashes, and empty segments before key construction. The fix returns a 400 Bad Request status with a clear error message for invalid paths, preventing the vulnerability regardless of underlying storage backend configuration.

Affected products

Trigger.dev Trigger.dev 4.4.2 to 4.5.0

Timeline

2026-08-13: disclosed
2026-06-05: patched: Fix merged in version 4.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.