CVE-2026-3748

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3748
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3748.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3748
Published
2026-03-08T16:16:02.020Z
Modified
2026-04-10T05:43:27.087970Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestController.java of the component SVG File Handler. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.4.5.1 is able to mitigate this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is recommended.

References

Affected packages

Git / github.com/bytedesk/bytedesk

Affected ranges

Type
GIT
Repo
https://github.com/bytedesk/bytedesk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
11c935585a679cd1ff1970311d081131828b7e28
Fixed
975e39e4dd527596987559f56c5f9f973f64eff7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.5.1"
        }
    ]
}

Affected versions

v0.*
v0.8.3.1
v0.8.4
v0.8.4.1
v0.8.5.1
v0.8.6
v0.8.7
v0.8.7.1
v0.8.8
v0.8.8.2
v0.8.8.3
v0.8.8.6
v0.8.8.7
v0.8.9
v0.8.9.1
v0.8.9.2
v0.8.9.3
v0.9.0
v0.9.1
v0.9.1.1
v0.9.2
v0.9.2.2
v0.9.2.3
v0.9.2.4
v0.9.3
v0.9.3.1
v0.9.3.2
v0.9.4
v0.9.4.2
v0.9.4.3
v0.9.5
v0.9.5.1
v0.9.6
v0.9.6.1
v0.9.7
v0.9.8
v0.9.8.1
v0.9.8.2
v0.9.8.3
v0.9.8.4
v0.9.8.5
v0.9.8.5.1
v0.9.8.6
v0.9.9
v0.9.9.1
v0.9.9.2
v0.9.9.3
v1.*
v1.0.0
v1.0.0.1
v1.0.1
v1.0.1.1
v1.0.1.3
v1.0.1.4
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.5
v1.1.6
v1.1.7
v1.2.0
v1.2.1
v1.2.5
v1.2.6
v1.3.0
v1.3.1
v1.3.5
v1.3.9
v1.4.5
v1.4.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3748.json"