CVE-2026-45088

{
  "id": "CVE-2026-45088",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T18:16:24.727",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0."
    },
    {
      "lang": "es",
      "value": "Dalfox es un potente escáner XSS de código abierto y una utilidad centrada en la automatización. Antes de la versión 2.13.0, cuando dalfox se ejecuta en modo de servidor API REST, el campo custom-payload-file en model.Options está etiquetado como JSON y se deserializa directamente del cuerpo de la solicitud del atacante, luego se propaga sin cambios a través de dalfox.Initialize al motor de escaneo. El motor pasa el valor a voltFile.ReadLinesOrLiteral, que lee líneas de cualquier ruta de archivo accesible para el proceso dalfox e incrusta cada línea como una carga útil XSS en las solicitudes HTTP salientes dirigidas a la URL objetivo controlada por el atacante. Debido a que el servidor no tiene una clave API por defecto, un atacante de red no autenticado puede exfiltrar el contenido de archivos arbitrarios en el host dalfox leyéndolos línea por línea a través del tráfico de escaneo. Esta vulnerabilidad se corrige en la versión 2.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "hahwul",
          "product": "dalfox",
          "versions": [
            {
              "version": "< 2.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T17:56:40.382510Z",
          "id": "CVE-2026-45088",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}