CVE-2026-73659 | triggerdotdev trigger.dev up to 4.4.x packet presign routes api.v1.packets.$.ts resolveStoreProtocolForPacketPresign filename path traversal

A vulnerability was found in triggerdotdev trigger.dev up to 4.4.x. It has been declared as critical. Affected by this vulnerability is the function resolveStoreProtocolForPacketPresign of the file apps/webapp/app/routes/api.v1.packets.$.ts of the component packet presign routes. Such manipulation of the argument filename leads to path traversal.

This vulnerability is documented as CVE-2026-73659. The attack can be executed remotely. There is not any exploit available.

It is recommended to upgrade the affected component.