Is CVE-2026-45088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45088 being exploited in the wild.

How severe is CVE-2026-45088?

High severity, with a CVSS score of 7.5, published 27 May 2026.

Which products and versions are affected?

github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.

Is there a fix for CVE-2026-45088?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45088 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45088?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45088: hahwul Dalfox unauthenticated arbitrary file read in REST API

Q: Is there a fix for CVE-2026-45088?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45088 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45088?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45088 · Severity: high · CVSS 7.5 · Published 2026-05-27

Dalfox, a tool used for scanning websites for security vulnerabilities, contains a flaw in its server mode that allows unauthorized users to read sensitive files from the host machine. By sending a specially crafted request to the Dalfox API, an attacker can force the server to read local files (such as passwords or private keys) and send their contents to an external server. This could lead to a full compromise of the server hosting the Dalfox instance.

Technologies: github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go), Hahwul Dalfox. Vendors: Go, Hahwul.

Quick answers

Is CVE-2026-45088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45088 being exploited in the wild.
How severe is CVE-2026-45088?: High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?: github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.
Is there a fix for CVE-2026-45088?: Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45088 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45088?: Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later
```
go get github.com/hahwul/dalfox/v2@v2.13.0
```

Technical details

Dalfox's REST API server mode fails to authenticate requests by default and lacks sanitization for the 'custom-payload-file' field in the scan options. An attacker can provide an arbitrary local file path in a POST request to the /scan endpoint. The application's scan engine reads this file line-by-line and embeds the content as XSS payloads in outbound HTTP requests directed at an attacker-controlled URL. This effectively exfiltrates the file's contents via query parameters. The vulnerability is rooted in 'pkg/server/server.go' and 'pkg/scanning/scan.go', where user-supplied options are passed directly to file-reading functions without validation or privilege checks. Version 2.13.0 addresses this by requiring an API key and stripping dangerous fields from API-sourced requests.

Affected products

hahwul dalfox <= 2.12.0

Identifiers

CVE-2026-45088
GHSA-35wr-x7v6-9fv2
GO-2026-5070

Timeline

2026-05-07: advisory: GitHub Advisory published
2026-05-12: disclosed: Vulnerability disclosed via GHSA-35wr-x7v6-9fv2
2026-06-08: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.