Vulnerability · Published Mar 7, 2026 · Assigned by VulDB

CVE-2026-3683bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in HotGo from bufanyun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload.go of the component Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
bufanyun	HotGo	2.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-349585 | bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery vdb-entry, technical-description
VDB-349585 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #765588 | bufanyun HotGo <= v2.0 Server-Side Request Forgery third-party-advisory
https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-1 exploit