# CVE-2026-78435: Faveo Helpdesk path traversal in logo deletion

Source: https://junglewise.ai/threats/cve-2026-78435-faveo-helpdesk-path-traversal-in-logo-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78435 · Severity: low · CVSS 3.8 · Published 2026-08-24

Faveo Helpdesk is a customer support ticketing system used by organizations to manage help requests. An authenticated admin user can exploit a path traversal vulnerability in the logo deletion feature to delete any file on the server that the web application can access, including critical configuration files, encryption keys, and application code. This could lead to complete service outage, loss of customer data, and exposure of sensitive secrets.

## Quick answers

**Is CVE-2026-78435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78435 being exploited in the wild.

**How severe is CVE-2026-78435?** Low severity, with a CVSS score of 3.8, published 24 August 2026.

**Which products and versions are affected?** Faveo Helpdesk up to 2.0.3.

**Is there a fix for CVE-2026-78435?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78435 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78435?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (CWE-22) and external control of file path (CWE-73) in the logo deletion endpoints. The vulnerable code in app/Http/Controllers/Admin/helpdesk/SettingsController.php and SettingsController2.php reads the file path directly from the GET parameter `data1` and passes it to the unlink() function without any validation or path restriction. An authenticated admin user can craft requests like GET /delete-logo?data1=/var/www/html/.env to delete arbitrary files. The attack requires an active admin session but no further user interaction. The application can be rendered non-functional by deleting critical files like .env or encryption keys, and session files can be deleted to terminate all active sessions and remove audit trails.

## Affected products

- Faveo Helpdesk up to 2.0.3

## Timeline

- 2026-07-01: disclosed: Security issue opened publicly on GitHub
- 2026-08-24: advisory: CVE-2026-78435 published

## References

- [https://github.com/faveosuite/faveo-helpdesk/issues/8343](https://github.com/faveosuite/faveo-helpdesk/issues/8343)
- [https://vuldb.com/cve/CVE-2026-78435](https://vuldb.com/cve/CVE-2026-78435)