Dalfox, an open‑source XSS scanner, exposes a file write capability when operating in REST API server mode. The flaw stems from the fact that the output, output‑all, and debug parameters are deserialized from an unauthenticated client request and forwarded directly to the daemon’s logger. The logger opens the supplied path with flags that allow creation and appending without performing any validation, and this logic exists outside the guard that distinguishes library use from server mode. Consequently, an unauthenticated attacker can create or append arbitrary files at any location writable by the Dalfox process, enabling tampering of configuration files, log spoofing, or laying groundwork for further exploitation. This corresponds to CWE‑306 (Missing Authentication), CWE‑434 (Improper Input Validation), and CWE‑73 (Relative Path Traversal).

The vulnerability affects every deployment of hahwul:dalfox running a version prior to 2.13.0 in server mode with the default configuration—specifically, where no API key protects the REST endpoint. All hosts where the Dalfox process is permitted to write to the local file system are susceptible.

The CVSS score of 8.2 marks this issue as high severity. EPSS data is not yet available and the vulnerability is not listed in CISA’s KEV catalog, yet the lack of authentication means that any network user reaching the HTTP endpoint can exploit the flaw. The attack requires only HTTP access to the REST API; no privileged credentials or additional local conditions are necessary. The potential impact includes unauthorized file creation or modification across the host, which can lead to system compromise or data corruption.