A vulnerability was found in Faveo Helpdesk up to 2.0.3, affecting the Logo Handler's unlink function in SettingsController.php, which allows for path traversal. The attack can be launched remotely, and the exploit has been disclosed to the public. However, the project has not responded yet. This issue requires immediate attention from defenders responsible for Faveo Helpdesk instances to assess exposure [truncated]
A CVE record describes a missing authentication vulnerability in Faveo Helpdesk up to 2.0.3, specifically in the post-ticket-reply endpoint. The CVE Program published this record on 2026-08-24T22:17:21.190Z and it was last modified on 2026-10-12T15:10:00.207Z. The NVD entry is currently Deferred. This vulnerability allows for missing authentication, which can be exploited remotely, impacting the confident [truncated]
