Description

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T22:17:27.333Z",
  "pubdate": "2026-08-13T22:17:27.333Z",
  "executiveSummary": "A path traversal vulnerability exists in the Trigger.dev open-source platform, specifically within the packet presign routes handled by apps/webapp/app/routes/api.v1.packets.$.ts and apps/webapp/app/v3/objectStore.server.ts.\nThe vulnerability allows an authenticated attacker possessing a valid project API key to supply a caller-controlled filename containing directory traversal sequences (..).\nThis unsanitized input is passed directly to the resolveStoreProtocolForPacketPresign function, which subsequently invokes generatePresignedUrl and generatePresignedRequest.\nConsequently, an attacker can successfully escape the designated object-store prefix restricted to packets/<projectRef>/<env>/.\nOn multi-organization self-hosted instances, this flaw enables unauthorized cross-organization reading or overwriting of sensitive offloaded task payloads and execution outputs.\nThe impact includes severe data confidentiality and integrity breaches across distinct organizational boundaries within shared deployment environments.\nThe vulnerability affects Trigger.dev versions ranging from 4.4.2 up to, but not including, 4.5.0, and requires a project API key for exploitation.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied path input within the packet presign routing logic of Trigger.dev.\nThe vulnerable components reside in the file apps/webapp/app/routes/api.v1.packets.$.ts, which processes packet presign requests, and the underlying storage abstraction layer located in apps/webapp/app/v3/objectStore.server.ts.\nDuring execution, the packet presign route accepts a caller-controlled filename parameter without adequately validating or sanitizing it against directory traversal patterns such as dot-dot-slash (..).\nThis unsanitized filename is passed directly into resolveStoreProtocolForPacketPresign.\nThe output is then leveraged by the generatePresignedUrl and generatePresignedRequest functions to construct storage service requests.\nBecause the input lacks strict path normalization or boundary enforcement, the presence of traversal sequences forces the storage path resolution logic to step outside the intended isolation boundary.\nInstead of being constrained to the expected object-store prefix of packets/<projectRef>/<env>/, the resolved storage path points to arbitrary locations within the object store bucket.\nTo exploit this vulnerability, an attacker must first obtain or utilize a valid project API key to authenticate against the API routes.\nThe attacker crafts a malicious HTTP request targeting the packet presign endpoint, embedding path traversal payloads within the filename parameter.\nUpon receiving the request, the application fails to restrict the path, generating a presigned URL or request that grants read or write access to data belonging to other projects or organizations stored in the same storage backend.\nIn multi-organization self-hosted deployments sharing a single object storage instance, this sequence of events permits malicious actors to read confidential offloaded task payloads, intercept sensitive workflow outputs, or overwrite critical task data belonging to foreign tenants, thereby violating core multi-tenancy isolation guarantees."
}