CVE-2026-45088

Go/github.com/hahwul/dalfox/v2 CVE-2026-45088: high 7.5, EPSS 0.40%

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

Action: Upgrade github.com/hahwul/dalfox/v2 to 2.13.0 or later.

go get github.com/hahwul/dalfox/v2@v2.13.0

Affected

Fixed versions

Sources

• osv: GHSA-35wr-x7v6-9fv2
• https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2
• https://nvd.nist.gov/vuln/detail/CVE-2026-45088
• https://github.com/hahwul/dalfox
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0

CVE-2026-45088 · published 2026-05-12T15:08:13Z · modified 2026-06-25T18:56:35.128210482Z · JSON

Go/github.com/hahwul/dalfox CVE-2026-45088: unknown, EPSS 0.40%

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5070
• https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2
• https://nvd.nist.gov/vuln/detail/CVE-2026-45088
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0

CVE-2026-45088 · published 2026-06-25T18:26:48Z · modified 2026-06-25T18:45:16.453403421Z · JSON

Go/github.com/hahwul/dalfox/v2 CVE-2026-45088: unknown, EPSS 0.40%

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Action: Upgrade github.com/hahwul/dalfox/v2 to 2.13.0 or later.

go get github.com/hahwul/dalfox/v2@v2.13.0

Affected

Fixed versions

Sources

• osv: GO-2026-5070#Go/github.com/hahwul/dalfox/v2
• https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2
• https://nvd.nist.gov/vuln/detail/CVE-2026-45088
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0

CVE-2026-45088 · published 2026-06-25T18:26:48Z · modified 2026-06-25T18:45:16.453403421Z · JSON