{"id":"CVE-2026-3748","summary":"Bytedesk SVG File UploadRestController.java uploadFile unrestricted upload","details":"A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestController.java of the component SVG File Handler. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.4.5.1 is able to mitigate this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is recommended.","modified":"2026-10-28T11:12:18.584775141Z","published":"2026-03-08T16:02:12.228Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3748.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.3.2"},{"last_affected":"1.3.2"},{"introduced":"1.3.3"},{"last_affected":"1.3.3"},{"introduced":"1.3.4"},{"last_affected":"1.3.4"},{"introduced":"1.3.6"},{"last_affected":"1.3.6"},{"introduced":"1.3.7"},{"last_affected":"1.3.7"},{"introduced":"1.3.8"},{"last_affected":"1.3.8"}]}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-284","CWE-434"]},"references":[{"type":"WEB","url":"https://github.com/Bytedesk/bytedesk/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3748.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3748"},{"type":"ADVISORY","url":"https://vuldb.com/?id.349726"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.768028"},{"type":"REPORT","url":"https://github.com/Bytedesk/bytedesk/issues/18"},{"type":"REPORT","url":"https://github.com/Bytedesk/bytedesk/issues/18#issue-3993448721"},{"type":"REPORT","url":"https://github.com/Bytedesk/bytedesk/issues/18#issuecomment-3976672973"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.349726"},{"type":"FIX","url":"https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7"},{"type":"FIX","url":"https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bytedesk/bytedesk","events":[{"introduced":"5ef98bc47fd5361ff6634b56ea6470a429023d07"},{"fixed":"975e39e4dd527596987559f56c5f9f973f64eff7"},{"fixed":"11c935585a679cd1ff1970311d081131828b7e28"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.3.1"},{"last_affected":"1.3.1"}]},{"range":[{"introduced":"1.3.5"},{"last_affected":"1.3.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.3.9"},{"last_affected":"1.3.9"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"975e39e4dd527596987559f56c5f9f973f64eff7"}]},{"source":"REFERENCES_TAG","original_tag":"v1.4.5.1","range":[{"fixed":"11c935585a679cd1ff1970311d081131828b7e28"}]}]}}],"versions":["1.3.0","1.3.1","1.3.5","1.3.9","v1.4.5","v1.3.9","v1.3.5","v1.3.1","v1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3748.json","vanir_signatures":[{"target":{"file":"modules/core/src/main/java/com/bytedesk/core/upload/UploadRestService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["119263892884504024833929955299481638240","247488366827430560660733224693109069440","64807556373159769613021316268551386418","129459010784434315299968034255102582954"]},"id":"CVE-2026-3748-169cd5ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/core/src/main/java/com/bytedesk/core/upload/UploadRestService.java","function":"isAllowedFileType"},"deprecated":false,"digest":{"function_hash":"239665538064221918822137323843569165916","length":250},"id":"CVE-2026-3748-24537a76"},{"source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/ai/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java","function":"getModels"},"deprecated":false,"digest":{"length":1079,"function_hash":"122479377341404698454209492226130383620"},"id":"CVE-2026-3748-2fddebe4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["274038167817269739131207143375726606964","231088674182546715214440626878168141466","125873938923490394089642852250377316645","305206919147638483988973742109998354758","78345020032677885389330333087139080724","102780520118596686145265438873401835287","234722997311563552250648405627910365183","287279851895798990821517797230125653745","328589660668664360804617660733196728334","70040389533810613799208026709645641419","333639715772249415968936304504393660204","158087350020528406775138451837588341100","183837220466426519624285819598675723263","104019709541608025677960492319484994012"]},"id":"CVE-2026-3748-54c16363","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/ai/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java"}},{"id":"CVE-2026-3748-5fa67ce2","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/core/src/main/java/com/bytedesk/core/upload/UploadWatermarkService.java","function":"addWatermarkToFile"},"deprecated":false,"digest":{"length":1023,"function_hash":"19921436927876736068494050971711185728"}},{"id":"CVE-2026-3748-89447cc3","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"function":"getModels","file":"modules/ai/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java"},"deprecated":false,"digest":{"function_hash":"199547493046601588533582479412271002333","length":1090}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["203589188997127141095948672585207992725","114696107345083631801758220094929244250","209891379899148326042658624705396774473","116342920394568358751259379117266774298","320135416038356137198816000325158582317","21604643685053250782849494598537188832","216350037245142520546562321410812482476","251657247136955412479909462709689956813","262630381942392472317936648650591691368","174651757654670359278714893284972322002","13016079383742014185217329021251825353","313193673879648476719459992801270254961","25903308969803038406497555464056195516","97061705530168754845845356010207277137"]},"id":"CVE-2026-3748-c477634f","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/ai/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7","target":{"file":"modules/core/src/main/java/com/bytedesk/core/upload/UploadWatermarkService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["91531239111343626948824861013361867594","13776270294228748140273300992181390009","43944076098349688543184146968861096459","157248747990220267138675049458815892620","115164519778757848364246433931824468179","48287455467883954215612363703563314438","85313483198942733024534709682045456133","61558225104195809358661665699836886348","170831519060947719092601331960963560397","156308797133923102124206777091130054924","306916567731788930440819421927880012099","297280219140277933947748369003834378788","256893620812549740093853771663745055896","232333915628026910362258300751765583021","19838192663085677633605750891179649998","89642158519041895924720047357138772915","240991295446361655273235313926955381812","321539634159326482797297867005544426360","233381286014526026081628881322491281196","58642526832059463025041283448999132020","216366972440273404147856008377872110245","335263281755682455509273376548176320291","276906675863204598660328760227015549404","96183534715993008127948978082506030754","280168172524694546920664799190677743544","243113021181552490575877670941711522564","25596605800802220218374278483422329584","315379503460022792917243629004247083545","137474060323791373653697514445717820539","118133373157864696644403789764644910125","131276632878645129765559331338304942985","323321504602585294263320155603354281600","332685128588667323564395960332865718323"]},"id":"CVE-2026-3748-fea760c9"}],"vanir_signatures_modified":"2026-10-28T11:12:18Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}