hahwul dalfox up to 2.12.x custom-payload-file Fieldmode dalfox.Initialize file inclusion

Summaryinfo

A vulnerability identified as problematic has been detected in hahwul dalfox up to 2.12.x. Affected by this vulnerability is the function dalfox.Initialize of the component custom-payload-file Fieldmode. This manipulation causes file inclusion. This vulnerability is tracked as CVE-2026-45088. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in hahwul dalfox up to 2.12.x. It has been declared as problematic. Affected by this vulnerability is the function dalfox.Initialize of the component custom-payload-file Fieldmode. The manipulation with an unknown input leads to a file inclusion vulnerability. The CWE definition for the vulnerability is CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. As an impact it is known to affect confidentiality. The summary by CVE is:

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-45088 since 05/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.13.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• hahwul

Name

• dalfox

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12

Website

• Product: https://github.com/hahwul/dalfox/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion