CVE-2026-53449

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.0

Description The psd print sessions dump CLI command accepts a filename argument that is passed to the fopen() function without path validation. An authenticated administrator with CLI access can overwrite arbitrary files that the coturn process has permission to write to. This occurs because the command string is used without proper validation after the psd prefix and leading spaces are removed, enabling the truncation and overwriting of files with session dump data.

Recommendations Update to version 4.13.0.