CVE-2026-45088
published 2026-05-27CVE-2026-45088: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.25%
16.3th percentile
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | hahwul_dalfox_v2 | >= 0 < 2.13.0 | 2.13.0 |
| hahwul | dalfox | < 2.13.0 | 2.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
hahwul dalfox up to 2.12.x custom-payload-file Fieldmode dalfox.Initialize file inclusion (GHSA-35wr-x7v6-9fv2)
vuldb·2026-05-27·CVSS 7.5
CVE-2026-45088 [HIGH] hahwul dalfox up to 2.12.x custom-payload-file Fieldmode dalfox.Initialize file inclusion (GHSA-35wr-x7v6-9fv2)
A vulnerability categorized as problematic has been discovered in hahwul dalfox up to 2.12.x. Affected is the function dalfox.Initialize of the component custom-payload-file Fieldmode. The manipulation results in file inclusion.
This vulnerability is identified as CVE-2026-45088. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
ghsa·2026-05-12
CVE-2026-45088 [HIGH] CWE-306 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`
## Summary
When dalfox is run in REST API server mode, the `custom-payload-file` field in `model.Options` is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through `dalfox.Initialize` into the scan engine. The engine passes the value to `voltFile.ReadLinesOrLiteral`, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-27
Published