CVE-2026-45089: Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

Synopsis

An unauthenticated arbitrary file create/append vulnerability exists in Dalfox, the open-source XSS scanner, when it is run in REST API server mode. A remote attacker can send a crafted JSON request body that supplies an attacker-controlled file path, which the server then opens and writes scan log output to with no authentication check in the default configuration. Successful exploitation lets an attacker create or append to any file writable by the dalfox process on the host filesystem, enabling log poisoning, configuration tampering, or privilege escalation depending on file permissions. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the dalfox REST API server over the network; default configurations bind the listener to a network interface with no firewall restriction.

• AuthenticationNot required

  No API key or credential is required in the default dalfox server configuration, so any network caller can submit a malicious request body.

• Victim interactionNot required

  Exploitation is fully server-side; no user action or social engineering is needed to trigger the file write.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker sends a single well-formed JSON request and the server writes to the supplied path without any race condition or environmental dependency.

Blast Radius

• Attacker creates or appends arbitrary content to any file writable by the dalfox process, including sensitive system files such as cron jobs, authorized_keys, or web-served content.
• Attacker poisons log files or configuration files consumed by other processes on the same host, potentially causing those processes to execute attacker-supplied instructions.
• Attacker causes minor service disruption by filling disk space through repeated large appends, degrading availability of the dalfox server and co-located services.