Dify EUVD-2026-30774

Exploitation requires the attacker to (1) hold a valid Dify account in any tenant on the target instance - trivially obtainable on Dify Cloud due to free open self-registration, and easy on any self-hosted Dify deployment that has not disabled signups - and (2) possess or guess the UUID of a target file uploaded by another tenant. UUIDs are 128-bit and not enumerable by brute force, so practical exploitation depends on UUID leakage through referrer headers, shared logs, screenshots, error messages, or chained vulnerabilities, which is the basis of the CVSS AC:H rating. Limiting factors: the endpoint truncates output at 3,000 characters per file, only previewable file types are returned, and the target deployment must be running Dify 1.14.1 or earlier with the /console/api/files/{file_id}/preview endpoint reachable from the attacker's network position.

CVSS 4.0 vector AV:N/AC:H/PR:N/UI:N/VC:H scores 8.2 (High) - network-reachable, no authentication required for the vector itself, high confidentiality impact, but high attack complexity. The AC:H rating is the key tension: it reflects the need to obtain valid file UUIDs, but the description and source code make clear no other obstacles exist once a UUID is known, and Dify Cloud's free self-registration effectively neutralizes the PR:N-vs-authenticated distinction. Publicly available exploit code (Huntr bounty disclosure) and VulnCheck reporting raise this above the average CWE-639 finding. No EPSS score or CISA KEV entry was provided in the input, so widespread mass-exploitation likelihood cannot be quantified, but the combination of trivial account creation on the SaaS offering, available PoC, and high-value targets (RAG document corpora often contain proprietary or PII data) makes this a real priority for any Dify deployment, especially self-hosted multi-tenant instances.

An attacker self-registers a free account on a Dify Cloud or multi-tenant Dify instance, obtains a victim file UUID through observation, log leakage, brute force, or social engineering, and issues an authenticated GET to /console/api/files/{file_id}/preview. The server returns up to 3,000 characters of the targeted document regardless of tenant ownership, leaking proprietary RAG content, API keys, or PII. A public PoC accompanies the Huntr bounty disclosure, lowering the skill barrier substantially.