CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55	Patch
https://github.com/coturn/coturn/releases/tag/4.13.0	Release Notes
https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r	Exploit Third Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-10 19:17

Updated : 2026-07-16 13:30

NVD link : CVE-2026-53449

Mitre link : CVE-2026-53449

CVE.ORG link : CVE-2026-53449

JSON object : View

Products Affected

coturn_project

coturn

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-53449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53449", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:23:37.703271Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coturn", "product": "coturn", "versions": [{"status": "affected", "version": "< 4.13.0"}]}]}], "published": "2026-07-10T19:17:24.073", "references": [{"url": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coturn/coturn/releases/tag/4.13.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0."}], "lastModified": "2026-07-16T13:30:39.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD1C31C5-9686-46F0-81FF-3441C00D22DE", "versionEndExcluding": "4.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}