CVE-2026-3749 | Bytedesk up to 1.3.9 SVG File UploadRestService.java handleFileUpload unrestricted upload (Issue 19)

A vulnerability was found in Bytedesk up to 1.3.9. It has been declared as critical. This vulnerability affects the function handleFileUpload of the file source-code/src/main/java/com/bytedesk/core/upload/UploadRestService.java of the component SVG File Handler. Executing a manipulation can lead to unrestricted upload.

This vulnerability is handled as CVE-2026-3749. The attack can be executed remotely. Additionally, an exploit exists.

It is recommended to upgrade the affected component.