DEBIAN-CVE-2026-53449

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-53449

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53449.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-53449

Upstream

CVE-2026-53449

Published

2026-07-10T19:17:24Z

Modified

2026-09-14T17:03:45Z

Severity

6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.

References

https://security-tracker.debian.org/tracker/CVE-2026-53449

Affected packages

Debian:12 / coturn

Package

Name: coturn
Purl: pkg:deb/debian/coturn?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.6.1-1

4.6.1-2

4.12.0-1

4.14.0-1

4.15.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53449.json"

Debian:13 / coturn