CVE-2026-78435: Faveo Helpdesk Path Traversal Vulnerability

CVE-2026-78435 Overview

CVE-2026-78435 is a path traversal vulnerability [CWE-22] affecting Faveo Helpdesk versions up to 2.0.3. The flaw resides in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php, part of the Logo Handler component. Attackers can manipulate the data1 argument to traverse directories and delete files outside the intended scope. The vulnerability is exploitable remotely but requires high privileges to trigger. Public exploit details have been disclosed, and the vendor has not responded to the initial issue report at the time of publication.

Critical Impact
Authenticated remote attackers with high privileges can exploit path traversal to delete arbitrary files handled by the Faveo Helpdesk logo functionality, potentially impacting application integrity and availability.

Affected Products

Faveo Helpdesk versions up to and including 2.0.3
app/Http/Controllers/Admin/helpdesk/SettingsController.php (Logo Handler component)
Deployments exposing the administrative settings interface

Discovery Timeline

2026-08-24 - CVE-2026-78435 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78435

Vulnerability Analysis

The vulnerability exists in the Logo Handler component of Faveo Helpdesk's administrative settings controller. The unlink function processes user-controlled input from the data1 parameter without validating or sanitizing the supplied path. This allows an authenticated attacker to reference files outside the intended logo directory using traversal sequences such as ../. The result is arbitrary file deletion within the permissions of the web application process. The public disclosure of exploitation details raises the likelihood of opportunistic attacks against exposed Faveo Helpdesk instances.

Root Cause

The root cause is missing input validation on the data1 argument passed to unlink in SettingsController.php. The application trusts the supplied filename and constructs a filesystem path without canonicalization or allowlisting. Path traversal characters are neither stripped nor rejected before the delete operation executes. This maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the administrative interface and authenticated privileges sufficient to invoke the logo management endpoint. An attacker submits a crafted request that sets data1 to a relative path containing traversal sequences. The controller then calls unlink on the resolved path, deleting the target file. Because the flaw operates on the file deletion primitive rather than file read or write, impact focuses on integrity and availability of application-accessible files. Details are documented in the GitHub Issue #8343 and the VulDB entry for CVE-2026-78435.

No verified proof-of-concept code is available in the referenced sources at this time. Review the vendor issue tracker and VulDB record for further technical context.

Detection Methods for CVE-2026-78435

Indicators of Compromise

HTTP requests to Faveo Helpdesk administrative endpoints containing data1 parameter values with ../ or encoded traversal sequences such as %2e%2e%2f
Unexpected file deletions in directories outside the configured logo storage path
Web server access logs showing authenticated administrative sessions issuing repeated logo settings requests with anomalous parameter content

Detection Strategies

Inspect application and web server logs for requests to the settings controller carrying suspicious data1 values
Deploy web application firewall rules that flag path traversal patterns in POST or GET parameters targeting Faveo Helpdesk
Monitor filesystem integrity for unexpected deletions in directories writable by the PHP process

Monitoring Recommendations

Enable verbose logging on the Faveo Helpdesk administrative interface and forward logs to a centralized platform
Alert on administrative account activity outside expected maintenance windows
Correlate file deletion events on the web server host with corresponding HTTP requests to identify traversal attempts

How to Mitigate CVE-2026-78435

Immediate Actions Required

Restrict access to the Faveo Helpdesk administrative interface using network segmentation, IP allowlisting, or VPN gating
Audit administrative accounts and enforce strong authentication to reduce the pool of users who can reach the vulnerable endpoint
Review recent web server logs for data1 parameter values containing traversal sequences and investigate any anomalies

Patch Information

At the time of this article's publication, the Faveo Helpdesk project had not responded to the disclosure, and no vendor patch is referenced in the NVD entry. Monitor the Faveo Helpdesk GitHub repository for updates and apply any released fix promptly once available.

Workarounds

Remove or disable the logo update functionality in SettingsController.php until a vendor fix is issued
Apply a local patch that validates the data1 argument against an allowlist of expected filenames before invoking unlink
Run the Faveo Helpdesk PHP process under a least-privileged user account so that any traversal is limited by filesystem permissions
Deploy a WAF signature that blocks traversal characters in requests to the settings controller

bash

# Example WAF rule pattern (ModSecurity syntax) to block traversal in data1
SecRule ARGS:data1 "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1026078435,phase:2,deny,status:403,\
     msg:'CVE-2026-78435 path traversal attempt in Faveo Helpdesk data1'"