{"id":"CVE-2026-53449","summary":"Coturn: Arbitrary File Write via CLI psd Command","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.","aliases":["GHSA-jj76-vwjw-w34r"],"modified":"2026-08-12T16:41:08.529712Z","published":"2026-07-10T17:59:11.161Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53449.json"},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53449.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53449"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"bd02141ad865830fdea420ca0c803edf5ba8240c"},{"fixed":"e72930f571beba3bc7a9f97661af2614aae92a55"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.13.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*"}}],"versions":["docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53449.json","vanir_signatures_modified":"2026-08-12T16:41:08Z","vanir_signatures":[{"id":"CVE-2026-53449-4bfbf7f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55","target":{"file":"src/apps/relay/turn_admin_server.c","function":"myprintf"},"deprecated":false,"digest":{"function_hash":"124807049170472698590980517623440671590","length":267}},{"deprecated":false,"digest":{"line_hashes":["91676490237323141207091359087278169563","134619146134078491825593257481949521984","240206914456668321679209657510115428475","325382379396046350057213397868720420468","145191649691649807234600984128799022481","17201258256743746904010650237311432542","36324194885104580938409342489767407152","87770703340099349750080309860383803504","330373421597181111522391771134458405087","34398338204649847440005454461865539910","195505729225941936279197507527111968946","165080495133632419453406098716912093193","75727527448105775467292699796925186513","1312131354413535738495988301905136240","250767896894037716577550163761376347979","8571324952605226039204545409974422200","328626415755885330430978577358357477850","296015280120173367679537765808561445888","73493508738490946580915479433815673941","316842728057515878223347372582468325770","11181466233488629168072969007951645127","281011919122934324962928265969351347433","12012180792256342854081773127761404798","153943552575394449956487332606708154134","284117924204985241440957091482174304118","4330777079935803896941130845677256604","13948285417259784190832332535894722677","326234533034548444564258555734492041711","210284934137945260269533869775987122541","173738231439061679946921974889206202515","156138244275654954590804365541533990463","111537344801818031214860299191233018189","302609128965985780371032590923125450981","182747490682439219065279402245001882398","213430445590000220111660212019536498073","33391677133219434186175294094972086490","291057323173433540511925963510530399872","187781842889923129604960108982578333254","149098046972002941571117101580709971129","317308330447812600281785825239782067302","404164843190603625791468780805844895","304932394242015828701669979117581866011","295280223344031149016740841260566221441","30083201235803295575377714033908869146","336303915519596191141029488929094798344","67144417423298372999460256581026623107","318485260386762560405991851786728488764","35001241273640519027054539487786472222","192210594723504570546971272874755553670","70585149059163647944524908318321026311","30157839344941213072563297343493414038","169193743212664526770704569814712693599"],"threshold":0.9},"id":"CVE-2026-53449-8ad2a259","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55","target":{"file":"src/apps/relay/turn_admin_server.c"}},{"id":"CVE-2026-53449-bb225379","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55","target":{"file":"src/apps/relay/turn_admin_server.c","function":"print_sessions"},"deprecated":false,"digest":{"function_hash":"216405692580295337013650286950092656861","length":2494}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55","target":{"file":"src/apps/relay/turn_admin_server.c","function":"print_session"},"deprecated":false,"digest":{"function_hash":"119031598672048615957486817664889969543","length":5874},"id":"CVE-2026-53449-d1c3d150"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55","target":{"file":"src/apps/relay/turn_admin_server.c","function":"run_cli_input"},"deprecated":false,"digest":{"function_hash":"65414702076735944083329586716513727384","length":4887},"id":"CVE-2026-53449-fd344f6a"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}]}