CVE-2026-41948criticalexploração observadaCWE-23

CVE-2026-41948: falha crítica em langgenius dify

Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

90Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.3epss 23%
da publicação à arma
Publicada no NVD18 de mai.
VulnCheck+106d
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
langgenius · dify
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — langgenius dify

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 6.0%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 6.0%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.7%CVE-2026-85021MEDIUMlanggenius dify Splash Layout splash.tsx router.replace cross site scriptingEPSS 0.5%CVE-2026-61461HIGHDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textEPSS 0.5%CVE-2026-41949HIGHDify < 1.14.2 Authorization Bypass via File Preview EndpointEPSS 0.4%