CVE-2026-78435

Name of the Vulnerable Software and Affected Versions Faveo Helpdesk versions prior to 2.0.4

Description A path traversal issue exists in the Logo Handler component. A remote attacker can manipulate the data1 variable passed to the unlink() function within the app/Http/Controllers/Admin/helpdesk/SettingsController.php file to perform unauthorized file operations. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.