CVE-2026-53449

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53449
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53449.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53449
Aliases
  • GHSA-jj76-vwjw-w34r
Downstream
Published
2026-07-10T17:59:11.161Z
Modified
2026-08-12T16:41:08.529712Z
Severity
  • 6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Coturn: Arbitrary File Write via CLI psd Command
Details

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.

Database specific 
{
    "cwe_ids": [
        "CWE-73"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53449.json"
}
References

Affected packages

Git / github.com/coturn/coturn

Affected ranges

Type
GIT
Repo
https://github.com/coturn/coturn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bd02141ad865830fdea420ca0c803edf5ba8240c
Fixed
e72930f571beba3bc7a9f97661af2614aae92a55
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.13.0"
        }
    ]
}

Affected versions

4.*
4.10.0
4.11.0
4.12.0
4.4.5.3
4.4.5.4
4.5.0.1
4.5.0.2
4.5.0.3
4.5.0.4
4.5.0.5
4.5.0.6
4.5.0.7
4.5.1.0
4.5.1.1
4.5.1.2
4.5.1.3
4.5.2
4.6.0
4.6.2
4.6.3
4.7.0
4.8.0
4.9.0
docker/4.*
docker/4.10.0-r0
docker/4.10.0-r1
docker/4.11.0-r0
docker/4.12.0-r0
docker/4.5.2-r0
docker/4.5.2-r10
docker/4.5.2-r11
docker/4.5.2-r12
docker/4.5.2-r13
docker/4.5.2-r14
docker/4.5.2-r6
docker/4.5.2-r7
docker/4.5.2-r8
docker/4.5.2-r9
docker/4.6.0-r0
docker/4.6.0-r1
docker/4.6.1-r0
docker/4.6.1-r1
docker/4.6.1-r2
docker/4.6.1-r3
docker/4.6.2-r0
docker/4.6.2-r1
docker/4.6.2-r10
docker/4.6.2-r11
docker/4.6.2-r12
docker/4.6.2-r13
docker/4.6.2-r2
docker/4.6.2-r3
docker/4.6.2-r4
docker/4.6.2-r5
docker/4.6.2-r6
docker/4.6.2-r7
docker/4.6.2-r8
docker/4.6.2-r9
docker/4.6.3-r0
docker/4.6.3-r1
docker/4.6.3-r2
docker/4.6.3-r3
docker/4.7.0-r0
docker/4.7.0-r1
docker/4.7.0-r2
docker/4.7.0-r3
docker/4.7.0-r4
docker/4.8.0-r0
docker/4.8.0-r1
docker/4.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53449.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "124807049170472698590980517623440671590",
            "length": 267.0
        },
        "target": {
            "function": "myprintf",
            "file": "src/apps/relay/turn_admin_server.c"
        },
        "source": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55",
        "signature_version": "v1",
        "id": "CVE-2026-53449-4bfbf7f8",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "91676490237323141207091359087278169563",
                "134619146134078491825593257481949521984",
                "240206914456668321679209657510115428475",
                "325382379396046350057213397868720420468",
                "145191649691649807234600984128799022481",
                "17201258256743746904010650237311432542",
                "36324194885104580938409342489767407152",
                "87770703340099349750080309860383803504",
                "330373421597181111522391771134458405087",
                "34398338204649847440005454461865539910",
                "195505729225941936279197507527111968946",
                "165080495133632419453406098716912093193",
                "75727527448105775467292699796925186513",
                "1312131354413535738495988301905136240",
                "250767896894037716577550163761376347979",
                "8571324952605226039204545409974422200",
                "328626415755885330430978577358357477850",
                "296015280120173367679537765808561445888",
                "73493508738490946580915479433815673941",
                "316842728057515878223347372582468325770",
                "11181466233488629168072969007951645127",
                "281011919122934324962928265969351347433",
                "12012180792256342854081773127761404798",
                "153943552575394449956487332606708154134",
                "284117924204985241440957091482174304118",
                "4330777079935803896941130845677256604",
                "13948285417259784190832332535894722677",
                "326234533034548444564258555734492041711",
                "210284934137945260269533869775987122541",
                "173738231439061679946921974889206202515",
                "156138244275654954590804365541533990463",
                "111537344801818031214860299191233018189",
                "302609128965985780371032590923125450981",
                "182747490682439219065279402245001882398",
                "213430445590000220111660212019536498073",
                "33391677133219434186175294094972086490",
                "291057323173433540511925963510530399872",
                "187781842889923129604960108982578333254",
                "149098046972002941571117101580709971129",
                "317308330447812600281785825239782067302",
                "404164843190603625791468780805844895",
                "304932394242015828701669979117581866011",
                "295280223344031149016740841260566221441",
                "30083201235803295575377714033908869146",
                "336303915519596191141029488929094798344",
                "67144417423298372999460256581026623107",
                "318485260386762560405991851786728488764",
                "35001241273640519027054539487786472222",
                "192210594723504570546971272874755553670",
                "70585149059163647944524908318321026311",
                "30157839344941213072563297343493414038",
                "169193743212664526770704569814712693599"
            ]
        },
        "target": {
            "file": "src/apps/relay/turn_admin_server.c"
        },
        "source": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55",
        "signature_version": "v1",
        "id": "CVE-2026-53449-8ad2a259",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "216405692580295337013650286950092656861",
            "length": 2494.0
        },
        "target": {
            "function": "print_sessions",
            "file": "src/apps/relay/turn_admin_server.c"
        },
        "source": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55",
        "signature_version": "v1",
        "id": "CVE-2026-53449-bb225379",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "119031598672048615957486817664889969543",
            "length": 5874.0
        },
        "target": {
            "function": "print_session",
            "file": "src/apps/relay/turn_admin_server.c"
        },
        "source": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55",
        "signature_version": "v1",
        "id": "CVE-2026-53449-d1c3d150",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "65414702076735944083329586716513727384",
            "length": 4887.0
        },
        "target": {
            "function": "run_cli_input",
            "file": "src/apps/relay/turn_admin_server.c"
        },
        "source": "https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55",
        "signature_version": "v1",
        "id": "CVE-2026-53449-fd344f6a",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T16:41:08Z"