Security updates are an important part of maintaining a secure TrueConf deployment. This page provides information about publicly disclosed vulnerabilities affecting TrueConf products, including affected versions, severity levels, CVSS scores, technical impact, and available fixes.
The vulnerability table below is intended to help administrators identify whether a deployed version of TrueConf Server or TrueConf Client may be affected by a known security issue and determine whether an update is required.
How to use this page
Each vulnerability entry includes:
CVE— the unique identifier assigned to the vulnerability;
Product — the affected TrueConf product;
Affected version — the version or version range known to be affected;
Vulnerability — the general vulnerability type, such as SQL injection, cross-site scripting, or DLL hijacking;
CVSS severity — the severity classification derived from the published CVSS base score;
CVSS — the published Common Vulnerability Scoring System score.
Select a CVE entry to view additional information about the vulnerability, including the affected component, attack conditions, potential impact, CVSS vector, and the fixed version when this information is available.
|
CVE / BDU |
Product |
Affected version |
Vulnerability |
CVSS severity |
CVSS |
| › |
CVE-2026-72530 |
TrueConf Server |
<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5 |
Sandbox Escape / Code Injection |
Critical |
9.0 |
CVE-2026-72530: Sandbox Escape / Code Injection
Improper management of code generation can allow an attacker who has achieved code execution in the TrueConf Server isolated environment to escape the sandbox and execute arbitrary commands on the underlying operating system.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Isolated execution environment / code generation |
CVSS vector / score source
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Other identifiers
BDU:2026-11247; KLCERT-26-058 |
Resolution: 5.3.9 / 5.4.9 / 5.5.5
| › |
CVE-2026-72529 |
TrueConf Server |
<5.3; 5.3.x<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5 |
Missing Authentication |
Critical |
9.8 |
CVE-2026-72529: Missing Authentication
A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Service on 4307/TCP |
CVSS vector / score source
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Other identifiers
KLCERT-26-057 |
Resolution: 5.3.9 / 5.4.9 / 5.5.5
| › |
CVE-2026-3502 |
TrueConf Client |
8.1.0–8.5.2 |
Unverified Update / RCE |
High |
7.8 |
CVE-2026-3502: Unverified Update / RCE
The client update mechanism can apply downloaded update code without sufficient verification, allowing a malicious update source to deliver arbitrary code.
|
Attack vector
Adjacent |
Privileges required
High |
User interaction
Required |
|
Affected component
Update mechanism |
CVSS vector / score source
CVSS 3.1 score 7.8 |
Other identifiers
BDU:2026-04546 |
| › |
BDU:2026-03128 |
TrueConf Server |
Windows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016 |
Server-Side Request |
Medium |
4.3 |
BDU:2026-03128: Server-Side Request
Insufficient protection of service data can allow a remote attacker to initiate a request on behalf of the TrueConf Server.
|
Attack vector
Network |
Privileges required
Low |
User interaction
None |
|
Affected component
Server method |
CVSS vector / score source
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Other identifiers
— |
Resolution: 5.5.2.11029 Windows / 5.5.2.11041 Linux; 5.4.8.10015 Windows / 5.4.8.10016 Linux
| › |
BDU:2026-03093 |
TrueConf Server |
Windows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016 |
Path Traversal / File Deletion |
High |
7.7 |
BDU:2026-03093: Path Traversal / File Deletion
A relative-path handling flaw can allow a remote attacker to delete an arbitrary file and cause denial of service.
|
Attack vector
Network |
Privileges required
Not specified |
User interaction
Not specified |
|
Affected component
Server method / path handling |
CVSS vector / score source
CVSS 3.1 score 7.7 |
Other identifiers
— |
Resolution: 5.5.2.11029 Windows / 5.5.2.11041 Linux; 5.4.8.10015 Windows / 5.4.8.10016 Linux
| › |
BDU:2026-03092 |
TrueConf Server |
Windows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016 |
Path Traversal / RCE |
High |
8.5 |
BDU:2026-03092: Path Traversal / RCE
A relative-path handling flaw in a TrueConf Server method can allow a remote attacker to execute arbitrary code.
|
Attack vector
Network |
Privileges required
Not specified |
User interaction
Not specified |
|
Affected component
Server method / path handling |
CVSS vector / score source
CVSS 3.1 score 8.5 |
Other identifiers
— |
Resolution: 5.5.2.11029 Windows / 5.5.2.11041 Linux; 5.4.8.10015 Windows / 5.4.8.10016 Linux
| › |
BDU:2025-16342 |
TrueConf Server |
See BDU record |
Observable Response Discrepancy |
Medium |
5.3 |
BDU:2025-16342: Observable Response Discrepancy
Differences in responses to incoming requests can allow a remote attacker to determine information about a property of an object.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Server response handling |
CVSS vector / score source
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Other identifiers
COK-2025-10-23 |
| › |
BDU:2025-14307 |
TrueConf Server |
See BDU record |
Command Injection / DoS |
Medium |
6.4 |
BDU:2025-14307: Command Injection / DoS
Improper neutralization of special elements can allow a remote attacker to execute arbitrary commands and cause denial of service.
|
Attack vector
Network |
Privileges required
Not specified |
User interaction
Not specified |
|
Affected component
Server input handling |
CVSS vector / score source
CVSS 3.1 score 6.4 |
Other identifiers
— |
| › |
BDU:2025-13738 |
TrueConf Server |
<5.5.2 |
OS Command Injection |
High |
7.6 |
BDU:2025-13738: OS Command Injection
Improper neutralization of special elements can allow remote execution of arbitrary operating-system commands.
|
Attack vector
Network |
Privileges required
Depends on chain |
User interaction
None |
|
Affected component
Server input handling |
CVSS vector / score source
See BDU/CyberOK advisory |
Other identifiers
COK-2025-10-27 |
| › |
BDU:2025-13737 |
TrueConf Server |
<5.5.2 |
Brute-Force Protection Bypass |
Medium |
5.3 |
BDU:2025-13737: Brute-Force Protection Bypass
Insufficient limitation of authentication attempts can allow a remote attacker to perform brute-force attacks.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Authentication mechanism |
CVSS vector / score source
See BDU advisory |
Other identifiers
COK-2025-10-16 |
Resolution: 5.5.2, 5.4.7, 5.3.8
| › |
BDU:2025-13736 |
TrueConf Server |
<5.5.2 |
Authorization Bypass |
High |
7.5 |
BDU:2025-13736: Authorization Bypass
Weaknesses in the authorization procedure can allow a remote attacker to bypass existing security restrictions.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Authorization mechanism |
CVSS vector / score source
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Other identifiers
COK-2025-10-15 |
Resolution: 5.5.2, 5.4.7, 5.3.8
| › |
BDU:2025-11412 |
TrueConf Server |
<5.5.2 |
Reflected XSS |
Medium |
6.3 |
BDU:2025-11412: Reflected XSS
Insufficient protection of web-page structure can allow a remote attacker to perform a reflected cross-site scripting attack.
|
Attack vector
Network |
Privileges required
Varies by vector |
User interaction
Required |
|
Affected component
Web interface |
CVSS vector / score source
BDU CVSS 3.1 score 6.3 |
Other identifiers
COK-2025-09-08 |
Resolution: 5.5.2, 5.4.7, 5.3.8
| › |
BDU:2025-10116 |
TrueConf Server |
Before 5.3.7 / 5.4.6 / 5.5.1 |
Command Injection / RCE |
Critical |
9.8 |
BDU:2025-10116: Command Injection / RCE
Improper neutralization of special elements can allow a remote attacker to execute arbitrary operating-system commands.
|
Attack vector
Network |
Privileges required
Depends on chain |
User interaction
None |
|
Affected component
Server command handling |
CVSS vector / score source
CVSS 3.1 score 9.8 |
Other identifiers
— |
Resolution: 5.5.1, 5.4.6, 5.3.7
| › |
BDU:2025-10115 |
TrueConf Server |
Before 5.3.7 / 5.4.6 / 5.5.1 |
Arbitrary File Read |
High |
7.5 |
BDU:2025-10115: Arbitrary File Read
A relative-path handling vulnerability can allow an attacker to read arbitrary files on the system.
|
Attack vector
Network |
Privileges required
Depends on chain |
User interaction
None |
|
Affected component
Path handling |
CVSS vector / score source
Public reporting commonly cites CVSS 7.5 |
Other identifiers
— |
Resolution: 5.5.1, 5.4.6, 5.3.7
| › |
BDU:2025-10114 |
TrueConf Server |
Before 5.3.7 / 5.4.6 / 5.5.1 |
Authentication / Access Control Bypass |
High |
7.5 |
BDU:2025-10114: Authentication / Access Control Bypass
Insufficient access control can allow requests to certain administrative endpoints under /admin/* without authentication.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Administrative endpoints |
CVSS vector / score source
CVSS 3.1 score 7.5 |
Other identifiers
— |
Resolution: 5.5.1, 5.4.6, 5.3.7
| › |
CVE-2025-66835 |
TrueConf Client |
8.5.2 |
DLL Hijacking |
High |
7.1 |
CVE-2025-66835: DLL Hijacking
A crafted wfapi.dll can allow a local attacker to execute arbitrary code in the user's context.
|
Attack vector
Local |
Privileges required
Low |
User interaction
None |
|
Affected component
DLL loading |
CVSS vector / score source
CVSS 3.1 score 7.1 |
Other identifiers
— |
| › |
CVE-2025-66834 |
TrueConf Server |
5.5.2.10813 |
CSV Formula Injection |
High |
7.3 |
CVE-2025-66834: CSV Formula Injection
A normal user can inject malicious spreadsheet formulas into exported chat logs through a crafted Display Name.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
Chat log export |
CVSS vector / score source
CVSS 3.1 score 7.3 |
Other identifiers
BDU:2026-04923 |
| › |
CVE-2025-66824 |
TrueConf Server |
5.5.2.10813 |
Stored XSS |
High |
7.3 |
CVE-2025-66824: Stored XSS
Stored XSS in the Meeting location field can execute on the Conference Info page and may lead to account takeover.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
meeting_room |
CVSS vector / score source
CVSS 3.1 score 7.3 |
Other identifiers
BDU:2026-04922 |
| › |
CVE-2025-66823 |
TrueConf Server |
5.5.2.10813 |
HTML Injection |
Low |
3.5 |
CVE-2025-66823: HTML Injection
HTML injection in the conference description can trigger when a victim opens the Conference Info page.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
Conference description |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
BDU:2026-04921 |
| › |
CVE-2022-46764 |
TrueConf Server |
5.2.0.10225 |
SQL Injection |
Critical |
9.8 |
CVE-2022-46764: SQL Injection
A remote unauthenticated attacker can execute arbitrary SQL through the web API, potentially resulting in remote code execution.
|
Attack vector
Network |
Privileges required
None |
User interaction
None |
|
Affected component
Web API |
CVSS vector / score source
CVSS 3.1 score 9.8 |
Other identifiers
— |
| › |
CVE-2022-46763 |
TrueConf Server |
5.2.0.10225 |
SQL Injection |
High |
8.8 |
CVE-2022-46763: SQL Injection
A low-privileged database user can execute arbitrary SQL as the database administrator through a stored function.
|
Attack vector
Network |
Privileges required
Low |
User interaction
None |
|
Affected component
Database stored function |
CVSS vector / score source
CVSS 3.1 score 8.8 |
Other identifiers
— |
| › |
CVE-2017-20120 |
TrueConf Server |
4.3.7 |
CSRF |
Medium |
4.3 |
CVE-2017-20120: CSRF
Cross-site request forgery affects /admin/service/stop/.
|
Attack vector
Network |
Privileges required
None |
User interaction
Required |
|
Affected component
/admin/service/stop/ |
CVSS vector / score source
CVSS 3.1 score 4.3 |
Other identifiers
— |
| › |
CVE-2017-20119 |
TrueConf Server |
4.3.7 |
Open Redirect |
Low |
3.5 |
CVE-2017-20119: Open Redirect
An open redirect issue affects /admin/general/change-lang via redirect_url.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
redirect_url |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20118 |
TrueConf Server |
4.3.7 |
DOM XSS |
Low |
3.5 |
CVE-2017-20118: DOM XSS
DOM-based XSS affects /admin/conferences/list/ via domxss.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
domxss |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20117 |
TrueConf Server |
4.3.7 |
DOM XSS |
Low |
3.5 |
CVE-2017-20117: DOM XSS
DOM-based XSS affects /admin/group.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
/admin/group |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20116 |
TrueConf Server |
4.3.7 |
Reflected XSS |
Low |
3.5 |
CVE-2017-20116: Reflected XSS
Reflected XSS affects /admin/group/list/ via checked_group_id.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
checked_group_id |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20115 |
TrueConf Server |
4.3.7 |
Reflected XSS |
Low |
3.5 |
CVE-2017-20115: Reflected XSS
Reflected XSS affects /admin/conferences/list/ via sort.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
sort |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20114 |
TrueConf Server |
4.3.7 |
Reflected XSS |
Low |
3.5 |
CVE-2017-20114: Reflected XSS
Reflected XSS affects /admin/conferences/get-all-status/ via keys[].
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
keys[] |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
| › |
CVE-2017-20113 |
TrueConf Server |
4.3.7 |
Stored XSS |
Low |
3.5 |
CVE-2017-20113: Stored XSS
A stored cross-site scripting vulnerability affects TrueConf Server 4.3.7.
|
Attack vector
Network |
Privileges required
Low |
User interaction
Required |
|
Affected component
Not specified in source |
CVSS vector / score source
CVSS 3.1 score 3.5 |
Other identifiers
— |
Keeping TrueConf deployments secure
Administrators should keep TrueConf software up to date and review security information when new vulnerabilities are disclosed.
When a fixed version is listed, upgrading to that version or a newer supported release is recommended. If the public CVE record does not identify a specific fixed version, the entry on this page indicates this explicitly rather than inferring a remediation version.
The information provided here is based on publicly available CVE records and related vulnerability disclosures. Details may be updated as additional technical information becomes available.
FAQ
Where can I find information about TrueConf security flaws?
Security flaws affecting TrueConf products may require updating the affected software or reviewing its security configuration.
For information about authentication, encryption, administrator access, data protection, and other security mechanisms, see the TrueConf Server security documentation. For flaws addressed by newer releases, also check the TrueConf Release Notes.
How can I resolve TrueConf security issues?
The appropriate action depends on the type of security issue.
For HTTPS and access configuration, see the Web and HTTPS settings. For authentication, data protection, permissions, and other security settings, use the TrueConf Server security documentation.
If the issue is corrected in a newer product version, follow the official update instructions before upgrading.
Where can I find TrueConf security updates?
How are TrueConf security patches installed?
What should I do if a TrueConf exploit is reported?
Determine which TrueConf product and version are affected and compare them with the software deployed in your environment.
Then check the TrueConf Release Notes and current security update announcements for an updated version. TrueConf Server administrators should use the official update procedure when installing the recommended release.
What should I do if a TrueConf zero-day vulnerability is reported?
For a newly disclosed security problem, first check current TrueConf product announcements and the TrueConf Release Notes to determine whether an updated version is available.
Until remediation information is published, administrators should also review the relevant settings in the TrueConf Server security documentation and restrict unnecessary access to affected services where appropriate.
Follow us on social networks