{"id":48546,"date":"2026-06-11T16:47:53","date_gmt":"2026-06-11T13:47:53","guid":{"rendered":"https:\/\/trueconf.com/blog\/?p=48546"},"modified":"2026-08-12T16:57:46","modified_gmt":"2026-08-12T13:57:46","slug":"security-fixes-updates-and-advisories","status":"publish","type":"post","link":"https:\/\/trueconf.com/blog\/news\/security-fixes-updates-and-advisories","title":{"rendered":"TrueConf Security Vulnerabilities, Fixes and Advisories"},"content":{"rendered":"

Security updates are an important part of maintaining a secure TrueConf deployment. This page provides information about publicly disclosed vulnerabilities affecting TrueConf products, including affected versions, severity levels, CVSS scores, technical impact, and available fixes.<\/p>\n

The vulnerability table below is intended to help administrators identify whether a deployed version of TrueConf Server or TrueConf Client may be affected by a known security issue and determine whether an update is required.<\/p>\n

How to use this page<\/h2>\n

Each vulnerability entry includes:<\/p>\n

CVE<\/strong>\u2014 the unique identifier assigned to the vulnerability;
\nProduct <\/strong>\u2014 the affected TrueConf product;
\nAffected version<\/strong> \u2014 the version or version range known to be affected;
\nVulnerability <\/strong>\u2014 the general vulnerability type, such as SQL injection, cross-site scripting, or DLL hijacking;
\nCVSS severity<\/strong> \u2014 the severity classification derived from the published CVSS base score;
\nCVSS<\/strong> \u2014 the published Common Vulnerability Scoring System score.<\/p>\n

Select a CVE entry to view additional information about the vulnerability, including the affected component, attack conditions, potential impact, CVSS vector, and the fixed version when this information is available.<\/p>\n

\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
<\/th>\nCVE \/ BDU<\/th>\nProduct<\/th>\nAffected version<\/th>\nVulnerability<\/th>\nCVSS severity<\/th>\nCVSS<\/th>\n<\/tr>\n<\/thead>\n<\/table>\n
\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2026-72530<\/td>\nTrueConf Server<\/td>\n<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5<\/td>\nSandbox Escape \/ Code Injection<\/td>\nCritical<\/span><\/td>\n9.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2026-72530: Sandbox Escape \/ Code Injection<\/h3>\n

Improper management of code generation can allow an attacker who has achieved code execution in the TrueConf Server isolated environment to escape the sandbox and execute arbitrary commands on the underlying operating system.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Isolated execution environment \/ code generation<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

BDU:2026-11247; KLCERT-26-058<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.3.9 \/ 5.4.9 \/ 5.5.5<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2026-72529<\/td>\nTrueConf Server<\/td>\n<5.3; 5.3.x<5.3.9; 5.4.x<5.4.9; 5.5.x<5.5.5<\/td>\nMissing Authentication<\/td>\nCritical<\/span><\/td>\n9.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2026-72529: Missing Authentication<\/h3>\n

A remote unauthenticated attacker connecting to TrueConf Server over 4307\/TCP can invoke an undocumented critical function and execute an arbitrary script on the server.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Service on 4307\/TCP<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

KLCERT-26-057<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.3.9 \/ 5.4.9 \/ 5.5.5<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2026-3502<\/td>\nTrueConf Client<\/td>\n8.1.0\u20138.5.2<\/td>\nUnverified Update \/ RCE<\/td>\nHigh<\/span><\/td>\n7.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2026-3502: Unverified Update \/ RCE<\/h3>\n

The client update mechanism can apply downloaded update code without sufficient verification, allowing a malicious update source to deliver arbitrary code.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Adjacent<\/strong><\/td>\n

\n
Privileges required<\/div>\n

High<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Update mechanism<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.8<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

BDU:2026-04546<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 8.5.3<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2026-03128<\/td>\nTrueConf Server<\/td>\nWindows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016<\/td>\nServer-Side Request<\/td>\nMedium<\/span><\/td>\n4.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2026-03128: Server-Side Request<\/h3>\n

Insufficient protection of service data can allow a remote attacker to initiate a request on behalf of the TrueConf Server.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server method<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2.11029 Windows \/ 5.5.2.11041 Linux; 5.4.8.10015 Windows \/ 5.4.8.10016 Linux<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2026-03093<\/td>\nTrueConf Server<\/td>\nWindows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016<\/td>\nPath Traversal \/ File Deletion<\/td>\nHigh<\/span><\/td>\n7.7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2026-03093: Path Traversal \/ File Deletion<\/h3>\n

A relative-path handling flaw can allow a remote attacker to delete an arbitrary file and cause denial of service.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Not specified<\/strong><\/td>\n

\n
User interaction<\/div>\n

Not specified<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server method \/ path handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.7<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2.11029 Windows \/ 5.5.2.11041 Linux; 5.4.8.10015 Windows \/ 5.4.8.10016 Linux<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2026-03092<\/td>\nTrueConf Server<\/td>\nWindows <5.5.2.11029; Linux <5.5.2.11041; Windows <5.4.8.10015; Linux <5.4.8.10016<\/td>\nPath Traversal \/ RCE<\/td>\nHigh<\/span><\/td>\n8.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2026-03092: Path Traversal \/ RCE<\/h3>\n

A relative-path handling flaw in a TrueConf Server method can allow a remote attacker to execute arbitrary code.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Not specified<\/strong><\/td>\n

\n
User interaction<\/div>\n

Not specified<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server method \/ path handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 8.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2.11029 Windows \/ 5.5.2.11041 Linux; 5.4.8.10015 Windows \/ 5.4.8.10016 Linux<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-16342<\/td>\nTrueConf Server<\/td>\nSee BDU record<\/td>\nObservable Response Discrepancy<\/td>\nMedium<\/span><\/td>\n5.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-16342: Observable Response Discrepancy<\/h3>\n

Differences in responses to incoming requests can allow a remote attacker to determine information about a property of an object.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server response handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

COK-2025-10-23<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-14307<\/td>\nTrueConf Server<\/td>\nSee BDU record<\/td>\nCommand Injection \/ DoS<\/td>\nMedium<\/span><\/td>\n6.4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-14307: Command Injection \/ DoS<\/h3>\n

Improper neutralization of special elements can allow a remote attacker to execute arbitrary commands and cause denial of service.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Not specified<\/strong><\/td>\n

\n
User interaction<\/div>\n

Not specified<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server input handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 6.4<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.3, 5.4.8<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-13738<\/td>\nTrueConf Server<\/td>\n<5.5.2<\/td>\nOS Command Injection<\/td>\nHigh<\/span><\/td>\n7.6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-13738: OS Command Injection<\/h3>\n

Improper neutralization of special elements can allow remote execution of arbitrary operating-system commands.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Depends on chain<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server input handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

See BDU\/CyberOK advisory<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

COK-2025-10-27<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-13737<\/td>\nTrueConf Server<\/td>\n<5.5.2<\/td>\nBrute-Force Protection Bypass<\/td>\nMedium<\/span><\/td>\n5.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-13737: Brute-Force Protection Bypass<\/h3>\n

Insufficient limitation of authentication attempts can allow a remote attacker to perform brute-force attacks.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Authentication mechanism<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

See BDU advisory<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

COK-2025-10-16<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2, 5.4.7, 5.3.8<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-13736<\/td>\nTrueConf Server<\/td>\n<5.5.2<\/td>\nAuthorization Bypass<\/td>\nHigh<\/span><\/td>\n7.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-13736: Authorization Bypass<\/h3>\n

Weaknesses in the authorization procedure can allow a remote attacker to bypass existing security restrictions.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Authorization mechanism<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

COK-2025-10-15<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2, 5.4.7, 5.3.8<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-11412<\/td>\nTrueConf Server<\/td>\n<5.5.2<\/td>\nReflected XSS<\/td>\nMedium<\/span><\/td>\n6.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-11412: Reflected XSS<\/h3>\n

Insufficient protection of web-page structure can allow a remote attacker to perform a reflected cross-site scripting attack.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Varies by vector<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Web interface<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

BDU CVSS 3.1 score 6.3<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

COK-2025-09-08<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.2, 5.4.7, 5.3.8<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-10116<\/td>\nTrueConf Server<\/td>\nBefore 5.3.7 \/ 5.4.6 \/ 5.5.1<\/td>\nCommand Injection \/ RCE<\/td>\nCritical<\/span><\/td>\n9.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-10116: Command Injection \/ RCE<\/h3>\n

Improper neutralization of special elements can allow a remote attacker to execute arbitrary operating-system commands.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Depends on chain<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Server command handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 9.8<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.1, 5.4.6, 5.3.7<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-10115<\/td>\nTrueConf Server<\/td>\nBefore 5.3.7 \/ 5.4.6 \/ 5.5.1<\/td>\nArbitrary File Read<\/td>\nHigh<\/span><\/td>\n7.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-10115: Arbitrary File Read<\/h3>\n

A relative-path handling vulnerability can allow an attacker to read arbitrary files on the system.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Depends on chain<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Path handling<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

Public reporting commonly cites CVSS 7.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.1, 5.4.6, 5.3.7<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nBDU:2025-10114<\/td>\nTrueConf Server<\/td>\nBefore 5.3.7 \/ 5.4.6 \/ 5.5.1<\/td>\nAuthentication \/ Access Control Bypass<\/td>\nHigh<\/span><\/td>\n7.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

BDU:2025-10114: Authentication \/ Access Control Bypass<\/h3>\n

Insufficient access control can allow requests to certain administrative endpoints under \/admin\/* without authentication.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Administrative endpoints<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.1, 5.4.6, 5.3.7<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2025-66835<\/td>\nTrueConf Client<\/td>\n8.5.2<\/td>\nDLL Hijacking<\/td>\nHigh<\/span><\/td>\n7.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2025-66835: DLL Hijacking<\/h3>\n

A crafted wfapi.dll can allow a local attacker to execute arbitrary code in the user's context.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Local<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

DLL loading<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.1<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 8.5.3<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2025-66834<\/td>\nTrueConf Server<\/td>\n5.5.2.10813<\/td>\nCSV Formula Injection<\/td>\nHigh<\/span><\/td>\n7.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2025-66834: CSV Formula Injection<\/h3>\n

A normal user can inject malicious spreadsheet formulas into exported chat logs through a crafted Display Name.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Chat log export<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.3<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

BDU:2026-04923<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.3<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2025-66824<\/td>\nTrueConf Server<\/td>\n5.5.2.10813<\/td>\nStored XSS<\/td>\nHigh<\/span><\/td>\n7.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2025-66824: Stored XSS<\/h3>\n

Stored XSS in the Meeting location field can execute on the Conference Info page and may lead to account takeover.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

meeting_room<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 7.3<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

BDU:2026-04922<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.3<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2025-66823<\/td>\nTrueConf Server<\/td>\n5.5.2.10813<\/td>\nHTML Injection<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2025-66823: HTML Injection<\/h3>\n

HTML injection in the conference description can trigger when a victim opens the Conference Info page.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Conference description<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

BDU:2026-04921<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.5.3<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2022-46764<\/td>\nTrueConf Server<\/td>\n5.2.0.10225<\/td>\nSQL Injection<\/td>\nCritical<\/span><\/td>\n9.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2022-46764: SQL Injection<\/h3>\n

A remote unauthenticated attacker can execute arbitrary SQL through the web API, potentially resulting in remote code execution.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Web API<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 9.8<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.2.6.10025<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2022-46763<\/td>\nTrueConf Server<\/td>\n5.2.0.10225<\/td>\nSQL Injection<\/td>\nHigh<\/span><\/td>\n8.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2022-46763: SQL Injection<\/h3>\n

A low-privileged database user can execute arbitrary SQL as the database administrator through a stored function.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

None<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Database stored function<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 8.8<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.2.6.10025<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20120<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nCSRF<\/td>\nMedium<\/span><\/td>\n4.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20120: CSRF<\/h3>\n

Cross-site request forgery affects \/admin\/service\/stop\/.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

None<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

\/admin\/service\/stop\/<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 4.3<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20119<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nOpen Redirect<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20119: Open Redirect<\/h3>\n

An open redirect issue affects \/admin\/general\/change-lang via redirect_url.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

redirect_url<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20118<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nDOM XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20118: DOM XSS<\/h3>\n

DOM-based XSS affects \/admin\/conferences\/list\/ via domxss.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

domxss<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20117<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nDOM XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20117: DOM XSS<\/h3>\n

DOM-based XSS affects \/admin\/group.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

\/admin\/group<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20116<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nReflected XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20116: Reflected XSS<\/h3>\n

Reflected XSS affects \/admin\/group\/list\/ via checked_group_id.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

checked_group_id<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20115<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nReflected XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20115: Reflected XSS<\/h3>\n

Reflected XSS affects \/admin\/conferences\/list\/ via sort.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

sort<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20114<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nReflected XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20114: Reflected XSS<\/h3>\n

Reflected XSS affects \/admin\/conferences\/get-all-status\/ via keys[].<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

keys[]<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n

\n\n\n\n\n\n\n\n\n\n<\/colgroup>\n\n\n
\u203a<\/td>\nCVE-2017-20113<\/td>\nTrueConf Server<\/td>\n4.3.7<\/td>\nStored XSS<\/td>\nLow<\/span><\/td>\n3.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/summary>\n
\n

CVE-2017-20113: Stored XSS<\/h3>\n

A stored cross-site scripting vulnerability affects TrueConf Server 4.3.7.<\/p>\n\n\n\n\n
\n
Attack vector<\/div>\n

Network<\/strong><\/td>\n

\n
Privileges required<\/div>\n

Low<\/strong><\/td>\n

\n
User interaction<\/div>\n

Required<\/strong><\/td>\n<\/tr>\n

\n
Affected component<\/div>\n

Not specified in source<\/strong><\/td>\n

\n
CVSS vector \/ score source<\/div>\n

CVSS 3.1 score 3.5<\/strong><\/td>\n

\n
Other identifiers<\/div>\n

\u2014<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Resolution:<\/strong> 5.0.2<\/p>\n<\/div>\n<\/div>\n<\/details>\n<\/div>\n

Keeping TrueConf deployments secure<\/h2>\n

Administrators should keep TrueConf software up to date and review security information when new vulnerabilities are disclosed.<\/p>\n

When a fixed version is listed, upgrading to that version or a newer supported release is recommended. If the public CVE record does not identify a specific fixed version, the entry on this page indicates this explicitly rather than inferring a remediation version.<\/p>\n

The information provided here is based on publicly available CVE records and related vulnerability disclosures. Details may be updated as additional technical information becomes available.<\/p>\n

\n

FAQ<\/h2>\n
\n
\n

Where can I find information about TrueConf security flaws?<\/p>\n

\n

Security flaws affecting TrueConf products may require updating the affected software or reviewing its security configuration.<\/p>\n

For information about authentication, encryption, administrator access, data protection, and other security mechanisms, see the TrueConf Server security documentation<\/a>. For flaws addressed by newer releases, also check the TrueConf Release Notes.<\/p>\n<\/div>\n<\/div>\n

\n

How can I resolve TrueConf security issues?<\/p>\n

\n

The appropriate action depends on the type of security issue.<\/p>\n

For HTTPS and access configuration, see the Web and HTTPS settings<\/a>. For authentication, data protection, permissions, and other security settings, use the TrueConf Server security documentation<\/a>.<\/p>\n

If the issue is corrected in a newer product version, follow the official update instructions before upgrading.<\/p>\n<\/div>\n<\/div>\n

\n

Where can I find TrueConf security updates?<\/p>\n

\n

Security-related releases are covered in TrueConf product update announcements and release information.<\/p>\n

For recent TrueConf Server recommendations, see TrueConf Server: Security Updates for June 2026<\/a>. The complete product release history is available in the TrueConf Release Notes<\/a>.<\/p>\n

TrueConf Server update procedures are described in the Installation and Update<\/a> documentation.<\/p>\n<\/div>\n<\/div>\n

\n

How are TrueConf security patches installed?<\/p>\n

\n

Security corrections are generally delivered as part of TrueConf product updates rather than through a separate patch catalog.<\/p>\n

Check the required product version in the TrueConf Release Notes<\/a>, then follow the TrueConf Server Installation and Update guide<\/a> to deploy the update.<\/p>\n

For security releases published in June 2026, also review the TrueConf Server security update announcement<\/a>.<\/p>\n<\/div>\n<\/div>\n

\n

What should I do if a TrueConf exploit is reported?<\/p>\n

\n

Determine which TrueConf product and version are affected and compare them with the software deployed in your environment.<\/p>\n

Then check the TrueConf Release Notes<\/a> and current security update announcements for an updated version. TrueConf Server administrators should use the official update procedure<\/a> when installing the recommended release.<\/p>\n<\/div>\n<\/div>\n

\n

What should I do if a TrueConf zero-day vulnerability is reported?<\/p>\n

\n

For a newly disclosed security problem, first check current TrueConf product announcements and the TrueConf Release Notes<\/a> to determine whether an updated version is available.<\/p>\n

Until remediation information is published, administrators should also review the relevant settings in the TrueConf Server security documentation<\/a> and restrict unnecessary access to affected services where appropriate.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

Security updates are an important part of maintaining a secure TrueConf deployment. This page provides information about publicly disclosed vulnerabilities affecting TrueConf products, including affected versions, severity levels, CVSS scores, technical impact, and available fixes. The vulnerability table below is intended to help administrators identify whether a deployed version of TrueConf Server or TrueConf Client […]<\/p>\n","protected":false},"author":54,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[104],"tags":[386],"class_list":["post-48546","post","type-post","status-publish","format-standard","hentry","category-news","tag-security","wpautop"],"_links":{"self":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/48546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/users\/54"}],"replies":[{"embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/comments?post=48546"}],"version-history":[{"count":31,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/48546\/revisions"}],"predecessor-version":[{"id":48609,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/posts\/48546\/revisions\/48609"}],"wp:attachment":[{"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/media?parent=48546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/categories?post=48546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trueconf.com/blog\/wp-json\/wp\/v2\/tags?post=48546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}