QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-3749

Back to search

CVE-2026-3749

Published: Mar 8, 2026

Modified: Mar 11, 2026

PUBLISHED

CVSS v3.1

6.3

MEDIUM

Description

A weakness has been identified in Bytedesk up to 1.3.9. This vulnerability affects the function handleFileUpload of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java of the component SVG File Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.4.5.1 is able to resolve this issue. This patch is called 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component.

VendorProductVersions

n/a

Bytedesk

affected
1.3.0
affected
1.3.1
affected
1.3.2
affected
1.3.3
affected
1.3.4

+6 more versions

Weaknesses (CWE)

CWE-434
CWE-284

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now