CVE-2026-45089

Description

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-45089 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine's logging path. The logger opens the attacker-supplied path with os.O_APPEND|os.O_CREATE|os.O_WRONLY and writes scan log lines to it. Critically, this file write block lives outside the IsLibrary guard in DalLog, so it executes even in server/library mode where file output was never intended to operate. Because no API key is required in the default configuration, an unauthenticated network caller can create or append to any file writable by the dalfox process on the host filesystem. This vulnerability is fixed in 2.13.0.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.2 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Effective score

8.2 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45089

Linked Threat

CVE-2026-45089 — CVE-2026-45089

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-32614

EUVD enrichment is queued; refresh the page in a few seconds.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 tenable:github.com
• https://github.com/hahwul/dalfox/security/advisories/GHSA-8hf9-3q64-q2qf tenable:github.com
• https://www.first.org/epss/ tenable:www.first.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-45089 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45089 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited
  web:blog.gridinsoft.com

  Microsoft has confirmed exploitation of two Microsoft Defender vulnerabilities fixed in the May 2026 security update cycle. CVE - 2026 -41091 is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, while CVE - 2026 -45498 is a denial-of-service flaw in the Microsoft Defender Antimalware Platform . The first bug matters more for incident response because a local authorized ...

  2026-05-26 02:52 UTC
• Microsoft and Adobe Patch Tuesday, February 2026 Security Update Review
  web:blog.qualys.com

  Microsoft's February 2026 Patch Tuesday focuses on closing security gaps that attackers could exploit, reinforcing the importance of timely patching in enterprise environments. Here's a quick…

  2026-05-26 02:52 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 02:52 UTC
• Security Update Guide - Loading - Microsoft
  web:msrc.microsoft.com

  Security Updates Acknowledgements

  2026-05-26 02:52 UTC
• Microsoft Issues Second Biggest Patch Tuesday Ever in April
  web:redmondmag.com

  Microsoft April 2026 Patch Tuesday fixed 163 CVEs , marking its second-largest security update. Three zero-day vulnerabilities impacted SharePoint, Chromium-based Edge workflows and Microsoft Defender.

  2026-05-26 02:52 UTC
• Microsoft Defender CVE-2026-41091 & CVE-2026-45498
  web:thecyberexpress.com

  Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.

  2026-05-26 02:52 UTC
• Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
  web:thehackernews.com

  Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...

  2026-05-26 02:52 UTC
• 138 CVEs Fixed: Netlogon RCE Leads Microsoft's Patch Pack - DNS Bug ...
  web:vulert.com

  Microsoft's May 2026 Patch Tuesday fixes 138 vulnerabilities, including critical Windows DNS and Netlogon RCE flaws. Learn the risks, key CVEs , mitigation steps, and how Vulert can help.

  2026-05-26 02:52 UTC
• Microsoft patches two zero-day flaws in Defender - CSO Online
  web:www.csoonline.com

  Microsoft released emergency fixes for two zero-day vulnerabilities in the malware protection components of Microsoft Defender. The flaws allow local attackers to gain system-level privileges or ...

  2026-05-26 02:52 UTC
• Microsoft Defender vulnerabilities exploited in the wild (CVE-2026 ...
  web:www.helpnetsecurity.com

  Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.

  2026-05-26 02:52 UTC

Only Available for Registered Users. Sign in to view.