Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
coturn coturn affected
Version Status Constraints
< 4.13.0 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Coturn Subscribe
Coturn Subscribe

Project Subscriptions

Vendors Products
Coturn Subscribe
Coturn Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55 cve-icon
https://github.com/coturn/coturn/releases/tag/4.13.0 cve-icon
https://github.com/coturn/coturn/security/advisories/GHSA-jj76-vwjw-w34r cve-icon
History

Fri, 10 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Coturn
Coturn coturn
Vendors & Products Coturn
Coturn coturn

Fri, 10 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.
Title Coturn: Arbitrary File Write via CLI psd Command
Weaknesses CWE-73
References
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-10T18:01:58.395Z

Reserved: 2026-06-09T16:31:21.494Z

Link: CVE-2026-53449

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-10T19:30:04Z

Weaknesses