CVE-2026-45088 affects Dalfox XSS scanner versions prior to 2.13.0. When running in REST API server mode, the tool is vulnerable to arbitrary file disclosure through unauthenticated requests. Attackers can exploit the custom-payload-file parameter to read any file accessible to the Dalfox process by manipulating JSON deserialization. The vulnerability allows remote file exfiltration through scan traffic directed at attacker-controlled URLs. This issue has been patched in version 2.13.0.