CVE-2026-3748 | Bytedesk up to 1.3.9 SVG File UploadRestController.java uploadFile unrestricted upload (Issue 18)

A vulnerability was found in Bytedesk up to 1.3.9. It has been classified as critical. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestController.java of the component SVG File Handler. Performing a manipulation results in unrestricted upload.

This vulnerability is known as CVE-2026-3748. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Upgrading the affected component is recommended.