Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-…

CVE-2026-45088 affects Dalfox XSS scanner versions prior to 2.13.0. When running in REST API server mode, the tool is vulnerable to arbitrary file disclosure through unauthenticated requests. Attackers can exploit the custom-payload-file parameter to read any file accessible to the Dalfox process by manipulating JSON deserialization. The vulnerability allows remote file exfiltration through scan traffic directed at attacker-controlled URLs. This issue has been patched in version 2.13.0.