Devolutions PowerShell Universal Improper Input Validation Vulnerability Allowing URL Path Conflicts and Denial-of-Service

A vulnerability exists in Devolutions PowerShell Universal versions prior to 2026.1.4, where improper input validation in the apps and endpoints configuration allows authenticated users with the right permissions to create or modify applications or endpoints. This flaw enables them to override existing application or system routes, leading to unintended request routing. The conflict in URL paths can cause a denial-of-service by disrupting normal application functionality.

Impact

Exploitation of this vulnerability can cause a denial-of-service by creating conflicting URL paths that disrupt normal application operations.

Remediation

Users are advised to upgrade to Devolutions PowerShell Universal version 2026.1.4 or later.