The vulnerability in Bytedesk’s SVG File Handler allows an attacker to send a specially crafted file to the uploadFile endpoint, bypassing file type checks (CWE‑434) and missing authorization checks (CWE‑284). This results in the placement of arbitrary files on the server, which can be used to deliver malicious code, modify application data, or prepare for later exploitation steps. No advanced exploitation tools are required; the flaw itself provides a remote upload vector.

Bytedesk versions 1.3.9 and earlier are vulnerable. The upstream repository shows that the issue was fixed in commit 975e39e4dd527596987559f56c5f9f973f64eff7 and the patch is included in release v1.4.5.1. No other vendors or product variants are listed in the available data.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% indicates a very low exploitation probability, suggesting that active attacks are unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by directing an HTTP POST to the uploadFile endpoint; the public exploit demonstrates this capability.