CVE-2026-3749Bytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload

5.3MediumCVSS base score
0.48%Exploitation in 30 daysEPSS · top 58% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

A weakness has been identified in Bytedesk up to 1.3.9. This vulnerability affects the function handleFileUpload of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java of the component SVG File Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.4.5.1 is able to resolve this issue. This patch is called 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits1

References tagged exploit1 reference

https://github.com/Bytedesk/bytedesk/issues/19#issue-3993480676 (opens in a new tab)exploitissue-tracking

Timeline

2026
7 Mar 2026
7 Mar 2026
ID reserved
By VulDB
8 Mar 20261 day later
8 Mar 2026· 1 day later
Published
11 Mar 20263 days later
11 Mar 2026· 3 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-3749, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	3.0	Medium6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
NVDNVD · Analyzed	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.48% · top 58% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

Bytedesk
- affected 1.3.0
- affected 1.3.1
- affected 1.3.2
- affected 1.3.3
- affected 1.3.4
- affected 1.3.5
- affected 1.3.6
- affected 1.3.7
- affected 1.3.8
- affected 1.3.9
- unaffected 1.4.5.1

References9

VDB-349727 | Bytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload (opens in a new tab)vdb-entrytechnical-description
VDB-349727 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
Submit #768030 | Bytedesk <=1.3.9 Unrestricted Upload of File with Dangerous Type (CWE-434) (opens in a new tab)third-party-advisory
https://github.com/Bytedesk/bytedesk/issues/19 (opens in a new tab)issue-tracking
https://github.com/Bytedesk/bytedesk/issues/19#issuecomment-3976672845 (opens in a new tab)issue-tracking
https://github.com/Bytedesk/bytedesk/issues/19#issue-3993480676 (opens in a new tab)exploitissue-tracking
https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7 (opens in a new tab)patch
https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.1 (opens in a new tab)patch
https://github.com/Bytedesk/bytedesk/ (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-3749](https://cveledger.app/badge/CVE-2026-3749.svg)](https://cveledger.app/cve/CVE-2026-3749)

Record last updated 11 Mar 2026, 19:39 UTC.