CVE-2026-41948

CRITICAL EPSS 39.6%
Published May 18, 20261mo ago · Modified Jun 22, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published May 18, 2026 1mo ago
Last Modified Jun 22, 2026 1w ago

Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
39.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-23

Affected Products 1

VendorProductVersionRange
difydify* ≤1.14.1

References 4

  • github.com https://github.com/langgenius/dify/pull/35796
    Issue TrackingMitigationPatch
  • huntr.com https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0
    ExploitThird Party Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access
    Third Party Advisory
  • zafran.io https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps

Remediation

  • github.com https://github.com/langgenius/dify/pull/35796
    Issue TrackingMitigationPatch