EUVD-2026-23809Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-preview.tsx of the component ImagePreview. The manipulation of the argument filename leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in Dify's ImagePreview component (web/app/components/base/image-uploader/image-preview.tsx) allows authenticated users to inject malicious scripts via the filename argument in the openInNewTab function, affecting versions up to 1.13.3. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting impact to low integrity compromise with no confidentiality or availability impact. Publicly available exploit code exists; vendor has not responded to early disclosure.
Technical ContextAI
The ImagePreview component in Dify's web application fails to properly sanitize the filename parameter before using it in the openInNewTab function, leading to stored or reflected cross-site scripting (CWE-79). Dify is a large language model (LLM) application development platform written in React/TypeScript. The vulnerable code path accepts user-controlled filename input-likely from image metadata or upload form fields-and inserts it unsanitized into DOM operations or URL construction without HTML encoding or Content Security Policy (CSP) protections. The attack surface is the image upload and preview functionality, a common user-facing feature in web applications. CPE cpe:2.3:a:langgenius:dify identifies the Dify application by Langgenius across all versions up to and including 1.13.3.
RemediationAI
Upgrade Dify to a version released after the vendor's response to this disclosure; exact patched version not confirmed from available data - check the Dify GitHub repository (https://github.com/langgenius/dify) for releases dated after the CVE publication or review pull requests addressing CWE-79 in the ImagePreview component. In the immediate term, implement input validation and output encoding in the openInNewTab function to HTML-encode or URI-encode the filename parameter before rendering it in DOM or constructing URLs; this prevents script injection while preserving legitimate filenames with special characters. Apply a Content Security Policy (CSP) header with script-src directive set to 'self' and a nonce-based or hash-based approach to restrict inline script execution, mitigating XSS payloads even if filename sanitization is bypassed. If using Dify in a multi-tenant environment, segregate user sessions with frame-ancestry or X-Frame-Options headers to limit session hijacking scope. Monitor image upload logs for suspicious filenames containing script tags or event handlers (e.g., '<img src=x onerror=alert()>') and block uploads matching such patterns. These controls carry minimal performance overhead but require coordination with development and security teams to deploy.
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another t
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute a
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters o
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess a
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely expl
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5
CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today