{"apiVersion":"1.0","identifier":"CVE-2026-73659","description":"Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization-s offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.","publishedAt":"2026-08-13T22:17:27","lastModifiedAt":"2026-08-14T17:20:35","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73659","cvssScore":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","epssProbability":0.00343,"riskScore":0.84,"affectedProduct":"Trigger.dev","affectedVersions":">=4.4.2,<4.5.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73659","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73659","en":"https://www.redsauce.net/en/cves/CVE-2026-73659","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73659","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73659","de":"https://www.redsauce.net/de/cves/CVE-2026-73659","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73659","el":"https://www.redsauce.net/el/cves/CVE-2026-73659"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73659"}}