PT-2026-23955 · Bytedesk · Bytedesk

Zast.Ai · Published 2026-03-08 · Updated 2026-03-08 · CVE-2026-3749

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bytedesk versions through 1.3.9

Description A weakness exists in Bytedesk that allows for unrestricted file uploads. The issue affects the handleFileUpload function within the SVG File Handler component, located at source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java. This manipulation can be executed remotely. The exploit is publicly available.

Recommendations Upgrade to version 1.4.5.1 to resolve this issue.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-3749

Affected Products

Bytedesk

References · 15

• 🔥 https://github.com/Bytedesk/bytedesk/issues/19#issue-3993480676 · Exploit
• https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.1 · Patch
• https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7 · Patch
• https://github.com/Bytedesk/bytedesk/issues/19#issuecomment-3976672845 · Vendor Advisory
• https://github.com/Bytedesk/bytedesk/issues/19 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3749 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3749 · Vendor Advisory
• https://github.com/Bytedesk/bytedesk · Note
• https://twitter.com/VulmonFeeds/status/2030685529650397332 · Twitter Post
• https://vuldb.com/?id.349727 · Note
• https://vuldb.com/?submit.768030 · Note
• https://t.me/cveNotify/154701 · Telegram Post
• https://twitter.com/CVEnew/status/2030747848732754161 · Twitter Post
• https://vuldb.com/?ctiid.349727 · Note
• https://t.me/CVEtracker/46820 · Telegram Post