TI-2026-32935 Aliases CVE-2026-45088 GHSA-35wr-x7v6-9fv2

Missing authentication in hahwul dalfox

HIGH 72CWE-306Published 2026-05-27 · Updated 2026-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306 and CWE-552.

Summary

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0031 24th percentileScored 2026-11-07

Fix Fixed dalfox (hahwul): 2.13.0github.com/hahwul/dalfox/v2 (Go): 2.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hahwul	dalfox	before 2.13.0	2.13.0	Patch available	CNA
—	github.com/hahwul/dalfox/v2 (Go)	before 2.13.0	2.13.0	Patch available	GHSA-35wr-x7v6-9fv2

dalfox Vendorhahwul Affected before 2.13.0 Fixed in 2.13.0 Patch available CNA
github.com/hahwul/dalfox/v2 (Go) Vendor— Affected before 2.13.0 Fixed in 2.13.0 Patch available GHSA-35wr-x7v6-9fv2

Remediation

Fix · CNA dalfox (hahwul) Fixed in 2.13.0
Fix · GHSA-35wr-x7v6-9fv2 github.com/hahwul/dalfox/v2 (Go) Fixed in 2.13.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45088
2026-10-03 Alias added: GHSA-35wr-x7v6-9fv2

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45088

Other 3

TI-2026-32934 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode CVSS 3.1CRITICAL 10.0
TI-2026-32936 Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode CVSS 3.1HIGH 8.2
TI-2026-32937 Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences