PT-2026-40551 · Hahwul+1 · Dalfox+1

Drmingler · Published 2026-05-12 · Updated 2026-05-27 · CVE-2026-45089

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dalfox versions prior to 2.13.0

Description When running in REST API server mode, the software fails to sanitize certain fields in the request body, allowing an unauthenticated network caller to create or append to any file writable by the process on the host filesystem. The issue occurs because the output, output-all, and debug fields in model.Options are deserialized directly from the request and passed to the scan engine's logging path. The logging function DalLog() opens the attacker-supplied path using os.O APPEND|os.O CREATE|os.O WRONLY and writes log lines to it, bypassing the IsLibrary guard intended to prevent file output in server mode. By default, no API key is required, enabling this unauthorized file manipulation.

Recommendations Update to version 2.13.0. As a temporary mitigation, restrict access to the REST API server or ensure it is not exposed to untrusted networks. Require the use of an API key by providing the --api-key flag at server startup to eliminate unauthenticated access.

Fix

Unrestricted File Upload

Missing Authentication

Weakness Enumeration

CWE-434

CWE-306

CWE-73

Related Identifiers

CVE-2026-45089

GHSA-8HF9-3Q64-Q2QF

Affected Products

Dalfox

Github.Com/Hahwul/Dalfox/V2

References · 6

• https://osv.dev/vulnerability/GHSA-8hf9-3q64-q2qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45089 · Security Note
• https://github.com/hahwul/dalfox · Note
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 · Note
• https://github.com/hahwul/dalfox/security/advisories/GHSA-8hf9-3q64-q2qf · Note
• https://twitter.com/CVEnew/status/2059718117572624533 · Twitter Post