CVE-2026-3748

Katalog CVE

CVSS 8.8 · High EPSS 0,69%

Kerentanan Improper Access Control pada bytedesk. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestController.java of the component SVG File Handler. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.4.5.1 is able to mitigate this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is recommended.

Rincian

Terbit di NVD

8 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Bytedesk/bytedesk/issues/18 exploit · issue tracking · advisory vendor
• https://github.com/Bytedesk/bytedesk/issues/18#issue-3993448721 exploit · issue tracking · advisory vendor
• https://github.com/Bytedesk/bytedesk/issues/18#issuecomment-3976672973 exploit · issue tracking · advisory vendor
• https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7 patch
• https://vuldb.com/?id.349726 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.768028 advisory pihak ketiga · vdb entry
• https://github.com/Bytedesk/bytedesk/ product
• https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.1 release notes
• https://vuldb.com/?ctiid.349726 permissions required