CVE-2026-45088

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45088", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T19:27:26.697Z", "datePublished": "2026-05-27T17:35:02.490Z", "dateUpdated": "2026-05-27T18:00:56.222Z"}, "containers": {"cna": {"title": "Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-552", "lang": "en", "description": "CWE-552: Files or Directories Accessible to External Parties", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"}, {"name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"}], "affected": [{"vendor": "hahwul", "product": "dalfox", "versions": [{"version": "< 2.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T17:35:02.490Z"}, "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0."}], "source": {"advisory": "GHSA-35wr-x7v6-9fv2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T17:56:40.382510Z", "id": "CVE-2026-45088", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:00:56.222Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45088", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:56:40.382510Z"}}}], "references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:56:11.351Z"}}], "cna": {"title": "Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode", "source": {"advisory": "GHSA-35wr-x7v6-9fv2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hahwul", "product": "dalfox", "versions": [{"status": "affected", "version": "< 2.13.0"}]}], "references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2", "name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552: Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T17:35:02.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45088", "state": "PUBLISHED", "dateUpdated": "2026-05-27T18:00:56.222Z", "dateReserved": "2026-05-08T19:27:26.697Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T17:35:02.490Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dalfox", "vendor": "hahwul", "versions": [{"status": "affected", "version": "< 2.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0."}, {"lang": "es", "value": "Dalfox es un potente esc\u00e1ner XSS de c\u00f3digo abierto y una utilidad centrada en la automatizaci\u00f3n. Antes de la versi\u00f3n 2.13.0, cuando dalfox se ejecuta en modo de servidor API REST, el campo custom-payload-file en model.Options est\u00e1 etiquetado como JSON y se deserializa directamente del cuerpo de la solicitud del atacante, luego se propaga sin cambios a trav\u00e9s de dalfox.Initialize al motor de escaneo. El motor pasa el valor a voltFile.ReadLinesOrLiteral, que lee l\u00edneas de cualquier ruta de archivo accesible para el proceso dalfox e incrusta cada l\u00ednea como una carga \u00fatil XSS en las solicitudes HTTP salientes dirigidas a la URL objetivo controlada por el atacante. Debido a que el servidor no tiene una clave API por defecto, un atacante de red no autenticado puede exfiltrar el contenido de archivos arbitrarios en el host dalfox ley\u00e9ndolos l\u00ednea por l\u00ednea a trav\u00e9s del tr\u00e1fico de escaneo. Esta vulnerabilidad se corrige en la versi\u00f3n 2.13.0."}], "id": "CVE-2026-45088", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45088", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T17:56:40.382510Z", "version": "2.0.3"}}]}, "published": "2026-05-27T18:16:24.727", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-552"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dalfox", "source": "cna", "vendor": "hahwul"}, "product": "dalfox", "vendor": "hahwul"}], "created": "2026-05-27T21:15:25.913014+00:00", "updated": "2026-05-29T15:50:23.347201+00:00", "vendors": ["hahwul", "hahwul$PRODUCT$dalfox"]}