EUVD-2026-30771
GHSA-h666-98mq-949j
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 18, 2026
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and reach the Plugin Daemon's internal REST API, including debug interfaces, by smuggling unencoded dot sequences through task identifiers or filename parameters. Because Dify Cloud permits unauthenticated free self-registration, the authentication barrier collapses to trivial account creation, and publicly available exploit code exists; the attacker only needs the victim tenant's UUID to pivot. CVSS 4.0 is rated 9.2 with high confidentiality and integrity impact.
Earlier versions of this analysis (1)
Path traversal in Dify 1.14.1 and earlier enables authenticated users to escape tenant boundaries and access internal Plugin Daemon REST API endpoints, including debug interfaces, by injecting unencoded dot sequences in task identifiers or filename parameters. Public exploit code exists (CVSS 7.7), and the vulnerability is particularly critical for Dify Cloud deployments where attackers can freely self-register accounts without authentication, requiring only discovery of target tenant UUIDs to exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Dify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
Executive ViewAI
Dify versions 0-1.14.1 contain a critical vulnerability (CVE-2026-41948, CVSS 9.2) enabling authenticated users to escape tenant isolation and access other organizations' confidential data and internal APIs. Because Dify Cloud provides free account registration, any attacker can create an account in minutes and exploit this flaw using only a target tenant's UUID. Publicly available exploit code exists, and no vendor patch is currently available.
Within 24 hours: Determine if your organization uses Dify (self-hosted or cloud); if yes, document all connected data sources and dependent systems. Within 7 days: For self-hosted deployments, disable free registration, restrict Plugin Daemon network access to trusted internal networks only, and audit existing accounts for unauthorized cross-tenant access. Within 30 days: Monitor Dify security advisories for a patch targeting version 1.14.2 or later; when available, deploy immediately; if no patch is released within 60 days, initiate migration planning to alternative platforms.
No vendor-released patch identified at time of analysis. For self-hosted deployments: (1) Disable free account registration and require manual tenant provisioning by administrators only; (2) Implement network-level access controls restricting the Plugin Daemon to trusted internal subnets; (3) Disable the Plugin Daemon service entirely if not mission-critical; (4) Enable detailed audit logging on all multi-tenant API operations and monitor for anomalous cross-tenant access attempts. For Dify Cloud users: immediately escalate to Dify support requesting incident confirmation and remediation timeline; consider suspending Plugin Daemon functionality pending vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Dify 1.9.1 permits unauthenticated remote GET requests to the /console/api/system-features console endpoint, letting ano
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another t
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute a
Plaintext exposure of third-party service API keys in Dify prior to version 1.11.0 allows any authenticated non-administ
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters o
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess a
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely expl
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5
Exploit-DB