CVE-2026-53449: Coturn Path Traversal Vulnerability

CVE-2026-53449 Overview

CVE-2026-53449 is a file overwrite vulnerability in Coturn, the open source implementation of Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) servers. The flaw resides in the psd (print sessions dump) CLI command, which accepts a filename argument and passes it directly to fopen without path validation. An authenticated administrator with CLI access can truncate and overwrite any file writable by the Coturn process. The issue is tracked under [CWE-73] (External Control of File Name or Path) and is fixed in Coturn 4.13.0.

Critical Impact
An authenticated admin with Coturn CLI access can overwrite arbitrary files writable by the Coturn process, enabling integrity loss and potential service disruption.

Affected Products

Coturn versions prior to 4.13.0
TURN/STUN deployments exposing the Coturn CLI (cli-ip, cli-port) admin interface
Systems where the Coturn process runs with elevated file write permissions

Discovery Timeline

2026-07-10 - CVE-2026-53449 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53449

Vulnerability Analysis

Coturn exposes an administrative CLI, typically bound to a management interface, that supports operational commands including psd for dumping session state to disk. When an operator issues psd <filename>, the server strips the psd prefix and leading whitespace, then passes the remaining string directly to fopen in write mode. Because fopen(path, "w") truncates any existing file at the resolved path, the command can be used to destroy or corrupt files owned by, or writable by, the Coturn process user.

The attacker must already possess CLI administrator access, which limits the exploitation population but does not eliminate risk. In shared operational environments, semi-privileged operators, compromised bastion sessions, or delegated admins can escalate to full integrity impact against the host through targeted file overwrites.

Root Cause

The root cause is missing input validation in the psd command handler within src/apps/relay/turn_admin_server.c. The code accepted the raw user-supplied string as a filesystem path with no canonicalization, allowlisting, or restriction to a designated dump directory. There was also no check to prevent overwriting existing files or writing outside a controlled output location.

Attack Vector

Exploitation requires authenticated access to the Coturn admin CLI over the local or management network. An admin submits a psd command with an absolute path pointing to a sensitive file such as a configuration file, log, TLS key, or systemd unit writable by the Coturn user. The server opens the target with fopen in write mode, truncating it, and writes session dump data into the file.

// Patch excerpt: src/apps/relay/turn_admin_server.c
   struct bufferevent *bev;
   ioa_addr addr;
   telnet_t *ts;
-  FILE *f;
   char realm[STUN_MAX_REALM_SIZE + 1];
   char origin[STUN_MAX_ORIGIN_SIZE + 1];
   realm_params_t *rp;
// Source: https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55

The patch removes the unchecked FILE *f handling path that fed the attacker-controlled filename directly to fopen, replacing it with a safer session dump implementation.

Detection Methods for CVE-2026-53449

Indicators of Compromise

Unexpected modifications or truncation of files owned by or writable by the Coturn process user.
Coturn CLI session logs containing psd commands with absolute paths outside the intended dump directory.
Presence of session dump content (TURN allocation records) inside unrelated system or application files.
Coturn process file descriptor activity opening non-standard paths in write mode.

Detection Strategies

Audit Coturn CLI command history and telnet session logs for psd invocations, focusing on filename arguments containing /, .., or paths outside an approved dump directory.
Deploy filesystem integrity monitoring on directories writable by the Coturn user, including /etc/turnserver.conf, TLS material, and log paths.
Correlate process telemetry: identify fopen/open(O_WRONLY|O_TRUNC) syscalls from the Coturn process against files that are not the configured dump target.

Monitoring Recommendations

Forward Coturn admin CLI logs to centralized logging with alerts on psd commands executed from non-approved source addresses.
Monitor authentication events on the Coturn CLI port for unexpected admin sessions, especially outside change windows.
Track the Coturn process user's file write activity and alert on writes outside a designated allowlist of paths.

How to Mitigate CVE-2026-53449

Immediate Actions Required

Upgrade Coturn to version 4.13.0 or later, which removes the unvalidated fopen path in the psd handler.
Restrict access to the Coturn admin CLI by binding cli-ip to loopback or a dedicated management interface and enforcing firewall rules.
Rotate the Coturn CLI password (cli-password) and audit which operators hold admin credentials.
Run the Coturn process under a dedicated low-privilege user that cannot write to sensitive system paths.

Patch Information

The fix is available in Coturn 4.13.0. See the GitHub Security Advisory GHSA-jj76-vwjw-w34r, the GitHub Release 4.13.0, and the upstream commit for details.

Workarounds

Disable the Coturn CLI entirely if it is not required by setting no-cli in turnserver.conf.
Constrain the Coturn user's filesystem permissions so the process cannot write to configuration, key, or system directories.
Place the Coturn CLI port behind a management VPN or bastion and require multi-factor authentication for operator access.

bash

# /etc/turnserver.conf - reduce exposure of the admin CLI
no-cli
# If CLI is required, bind to loopback only and use a strong password
cli-ip=127.0.0.1
cli-port=5766
cli-password=<strong-random-value>