CVE-2026-3789
Bytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java of the component SpringAIGiteeRestController. Performing a manipulation of the argument apiUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 1.4.5.4 is able to address this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is advised.
| CWE | CWE-918 |
| Vendor | n/a |
| Product | bytedesk |
| Published | Mar 8, 2026 |
| Last Updated | Mar 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a bytedesk
Be the first to know when new medium vulnerabilities affecting n/a bytedesk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / Bytedesk
1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 1.3.5 1.3.6 1.3.7 1.3.8 1.3.9
References
vuldb.com: https://vuldb.com/?id.349756 vuldb.com: https://vuldb.com/?ctiid.349756 vuldb.com: https://vuldb.com/?submit.768044 github.com: https://github.com/Bytedesk/bytedesk/issues/21 github.com: https://github.com/Bytedesk/bytedesk/issues/21#issuecomment-3976672522 github.com: https://github.com/Bytedesk/bytedesk/issues/21#issue-3993531226 github.com: https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7 github.com: https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4 github.com: https://github.com/Bytedesk/bytedesk/
Credits
🔍 ZAST.AI (VulDB User)