Read the docs
TI-2026-50790 Aliases CVE-2026-72530GHSA-f8q9-f337-2p3r

Code injection in TrueConf Server

Priority CRITICAL 100Exploited in the wildCWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Why it matters now

Exploitation Active In CISA KEV since 2026-08-20CISA due date 2026-09-03
EPSS 0.01686 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed TrueConf Server (TrueConf): 5.3.9, 5.4.9, 5.5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrueConfTrueConf Serverbefore 5.3; 5.3 to before 5.3.9; 5.4 to before 5.4.9; 5.5 to before 5.5.55.3.9, 5.4.9, 5.5.5Patch availableCNA
  • TrueConf Server VendorTrueConf Affected before 5.3; 5.3 to before 5.3.9; 5.4 to before 5.4.9; 5.5 to before 5.5.5 Fixed in 5.3.9, 5.4.9, 5.5.5 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:*before 5.3.9.10013VulnerableTrueConf
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:*before 5.3.9.10015VulnerableTrueConf
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:*5.4.0.12689 to before 5.4.9.10072VulnerableTrueConf
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:*5.4.0.12700 to before 5.4.9.10019VulnerableTrueConf
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:*5.5.0.13826 to before 5.5.5.10010VulnerableTrueConf
cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:*5.5.0.13828 to before 5.5.5.10009VulnerableTrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* Versions before 5.3.9.10013 Vulnerable ·TrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* Versions before 5.3.9.10015 Vulnerable ·TrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* Versions 5.4.0.12689 to before 5.4.9.10072 Vulnerable ·TrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* Versions 5.4.0.12700 to before 5.4.9.10019 Vulnerable ·TrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* Versions 5.5.0.13826 to before 5.5.5.10010 Vulnerable ·TrueConf
  • cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* Versions 5.5.0.13828 to before 5.5.5.10009 Vulnerable ·TrueConf

Remediation

  • Fix · CNA TrueConf Server (TrueConf) Fixed in 5.3.9, 5.4.9, 5.5.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    TrueConf Server 5.3, 5.3.9 and 2 more versions

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2026-50789 Missing authentication in TrueConf ServerPriority CRITICAL 99
    Show all 2 records →

Timeline

  1. 2026-08-20 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-72530
  3. 2026-10-03 Alias added: GHSA-f8q9-f337-2p3r

References

Exploit 1

Advisory 1

  • TI-2026-50789 Missing authentication in TrueConf Server KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-41058 A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of… CVSS 3.1HIGH 8.7
  • TI-2025-41059 A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal… CVSS 3.1HIGH 7.3
  • TI-2025-41057 An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference… CVSS 3.1MEDIUM 5.4
  • TI-2017-14186 TrueConf Server cross-site request forgery CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences