Executive brief
Faveo Helpdesk is a customer support ticketing system used by organizations to manage help requests. An authenticated admin user can exploit a path traversal vulnerability in the logo deletion feature to delete any file on the server that the web application can access, including critical configuration files, encryption keys, and application code. This could lead to complete service outage, loss of customer data, and exposure of sensitive secrets.
Technical details
The vulnerability is a path traversal (CWE-22) and external control of file path (CWE-73) in the logo deletion endpoints. The vulnerable code in app/Http/Controllers/Admin/helpdesk/SettingsController.php and SettingsController2.php reads the file path directly from the GET parameter `data1` and passes it to the unlink() function without any validation or path restriction. An authenticated admin user can craft requests like GET /delete-logo?data1=/var/www/html/.env to delete arbitrary files. The attack requires an active admin session but no further user interaction. The application can be rendered non-functional by deleting critical files like .env or encryption keys, and session files can be deleted to terminate all active sessions and remove audit trails.
Affected products
- Faveo Helpdesk up to 2.0.3
Timeline
- 2026-07-01: disclosed: Security issue opened publicly on GitHub
- 2026-08-24: advisory: CVE-2026-78435 published