CVE-2026-3683

2.1 lowEPSS 0.2%

Low (2.1). EPSS 0.2% chance of exploitation in the next 30 days.

A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload.go of the component Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-03-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-1
https://vuldb.com/?ctiid.349585
https://vuldb.com/?id.349585
https://vuldb.com/?submit.765588

Check your stack JSON