Bytedesk

4 CVEs product

Monthly

CVE-2026-3789 MEDIUM POC PATCH This Month

Server-side request forgery in Bytedesk versions up to 1.3.9 allows authenticated attackers to manipulate the apiUrl parameter in the SpringAIGiteeRestService component, enabling them to make arbitrary network requests from the affected server. Public exploit code exists for this vulnerability, which requires valid user credentials to exploit. Users should upgrade to version 1.4.5.4 or later to remediate the issue.

Java SSRF AI / ML Bytedesk
NVD GitHub VulDB
CVSS 3.1
6.3
EPSS
0.1%
CVE-2026-3788 MEDIUM POC PATCH This Month

Server-side request forgery in Bytedesk versions up to 1.3.9 allows authenticated attackers to manipulate the apiUrl parameter in the SpringAIOpenrouterRestController, enabling arbitrary HTTP requests from the affected server. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Upgrading to version 1.4.5.4 or later resolves this issue.

Java SSRF AI / ML Bytedesk
NVD GitHub VulDB
CVSS 3.1
6.3
EPSS
0.1%
CVE-2026-3749 MEDIUM POC PATCH This Month

Unrestricted file upload in Bytedesk versions up to 1.3.9 allows authenticated remote attackers to upload arbitrary SVG files through the handleFileUpload function in UploadRestService.java. Public exploit code exists for this vulnerability, and attackers can leverage it to bypass file upload restrictions and potentially execute malicious content. Upgrade to version 1.4.5.1 or apply patch 975e39e4dd527596987559f56c5f9f973f64eff7 to remediate.

Java Bytedesk
NVD GitHub VulDB
CVSS 3.1
6.3
EPSS
0.1%
CVE-2026-3748 MEDIUM POC PATCH This Month

Unrestricted file upload in Bytedesk versions up to 1.3.9 allows authenticated remote attackers to upload malicious SVG files through the UploadRestController component. Public exploit code exists for this vulnerability, which could enable attackers to execute arbitrary code or compromise system integrity. Update to version 1.4.5.1 or later to remediate this issue.

Java Bytedesk
NVD GitHub VulDB
CVSS 3.1
6.3
EPSS
0.1%
CVE-2026-3789
EPSS 0% CVSS 6.3
MEDIUM POC PATCH This Month

Server-side request forgery in Bytedesk versions up to 1.3.9 allows authenticated attackers to manipulate the apiUrl parameter in the SpringAIGiteeRestService component, enabling them to make arbitrary network requests from the affected server. Public exploit code exists for this vulnerability, which requires valid user credentials to exploit. Users should upgrade to version 1.4.5.4 or later to remediate the issue.

Java SSRF AI / ML +1
NVD GitHub VulDB
CVE-2026-3788
EPSS 0% CVSS 6.3
MEDIUM POC PATCH This Month

Server-side request forgery in Bytedesk versions up to 1.3.9 allows authenticated attackers to manipulate the apiUrl parameter in the SpringAIOpenrouterRestController, enabling arbitrary HTTP requests from the affected server. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Upgrading to version 1.4.5.4 or later resolves this issue.

Java SSRF AI / ML +1
NVD GitHub VulDB
CVE-2026-3749
EPSS 0% CVSS 6.3
MEDIUM POC PATCH This Month

Unrestricted file upload in Bytedesk versions up to 1.3.9 allows authenticated remote attackers to upload arbitrary SVG files through the handleFileUpload function in UploadRestService.java. Public exploit code exists for this vulnerability, and attackers can leverage it to bypass file upload restrictions and potentially execute malicious content. Upgrade to version 1.4.5.1 or apply patch 975e39e4dd527596987559f56c5f9f973f64eff7 to remediate.

Java Bytedesk
NVD GitHub VulDB
CVE-2026-3748
EPSS 0% CVSS 6.3
MEDIUM POC PATCH This Month

Unrestricted file upload in Bytedesk versions up to 1.3.9 allows authenticated remote attackers to upload malicious SVG files through the UploadRestController component. Public exploit code exists for this vulnerability, which could enable attackers to execute arbitrary code or compromise system integrity. Update to version 1.4.5.1 or later to remediate this issue.

Java Bytedesk
NVD GitHub VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy