Dify
Monthly
Server-side request forgery in Dify (LangGenius) before 1.13.0 allows unauthenticated remote attackers to make the Dify server fetch attacker-supplied URLs through the /console/api/remote-files/upload (POST) and /remote-files/<path:url> (GET) endpoints, turning the instance into a network pivot against internal services and cloud metadata endpoints. Rated CVSS 3.1 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), the issue is unauthenticated by design - the fix adds @login_required - but practical exploitability is bounded by Dify's existing ssrf_proxy wrapper, which may filter internal or metadata targets depending on allowlist configuration. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor-released patch (1.13.0) is available.
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute arbitrary SQL against the underlying ClickHouse database by passing unsanitized search parameters into the search_by_full_text method. Because those parameters are concatenated into the query without escaping or parameterization, an attacker can read, modify, or delete stored vector-store data. Publicly available exploit code exists (VulnCheck advisory and GitHub issue #38281) and a vendor patch is available; there is no confirmation of active in-the-wild exploitation.
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters of arbitrary uploaded files across all tenants and workspaces by submitting the file's UUID to the /console/api/files/{file_id}/preview endpoint. The flaw is amplified on Dify Cloud, where free self-registration makes account creation trivial, and publicly available exploit code exists via the Huntr disclosure. No CISA KEV listing has been recorded at time of analysis, but the combination of low-friction account access and a documented PoC raises practical exposure considerably.
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and reach the Plugin Daemon's internal REST API, including debug interfaces, by smuggling unencoded dot sequences through task identifiers or filename parameters. Because Dify Cloud permits unauthenticated free self-registration, the authentication barrier collapses to trivial account creation, and publicly available exploit code exists; the attacker only needs the victim tenant's UUID to pivot. CVSS 4.0 is rated 9.2 with high confidentiality and integrity impact.
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another tenant's LLM trace traffic - including prompts and model responses - to an attacker-controlled observability provider. Because Dify Cloud permits free self-registration, the authentication barrier is effectively trivial; publicly available exploit code exists and a vendor patch is shipped via PR #35793. The flaw is an instance of CWE-639 (insecure direct object reference) in the trace-configuration endpoints, which accepted an app_id without validating tenant ownership.
Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.
Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.
Server-side template injection (SSTI) in Dify's Jinja2 Handler (versions ≤1.14.2) allows remote, low-privileged authenticated attackers to inject malicious Jinja2 template expressions through the code execution subsystem, resulting in information disclosure and potential further impact. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. The vendor did not respond to responsible disclosure, meaning no patch has been released and no official mitigation guidance exists.
Open redirect in Dify's OAuth flow enables remote attackers to hijack post-authentication redirections, sending users to attacker-controlled sites that can harvest OAuth tokens or credentials. The flaw resides in the AppInitializer component's oauth_redirect_url handling, where the redirect destination is not validated against an allowlist. Exploitation requires user interaction - a target must follow a crafted link - but no authentication is required of the attacker, making phishing-based delivery straightforward. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Dify before version 1.14.0 allows authenticated users to bypass authorization controls and read arbitrary files uploaded by other users within the same tenant by supplying unauthorized file UUIDs in chat-messages API requests. The vulnerability exploits insufficient permission verification on file access endpoints, enabling attackers to circumvent workspace separation and signed URL protections to retrieve sensitive file contents processed through workflows. Publicly available exploit code exists, and a vendor-released patch (version 1.14.0) is available.
Unauthenticated users can upload SVG files containing XSS payloads via POST /api/files/upload in Dify prior to version 1.13.1, allowing cross-site scripting attacks against application users. The authenticated endpoint POST /v1/files/upload is similarly vulnerable. This vulnerability enables attackers to execute arbitrary JavaScript in the context of victim browsers, potentially compromising user sessions or stealing sensitive data without requiring any authentication or user interaction.
Dify prior to version 1.13.1 allows any authenticated user to delete other users' chat histories via the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> endpoint due to insufficient authorization checks. An authenticated attacker can target any conversation ID to perform unauthorized deletion, resulting in data loss for other users. This vulnerability requires valid Dify authentication but no special privileges, affecting all vulnerable versions via network access.
Cross-site scripting in Dify's ImagePreview component (web/app/components/base/image-uploader/image-preview.tsx) allows authenticated users to inject malicious scripts via the filename argument in the openInNewTab function, affecting versions up to 1.13.3. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting impact to low integrity compromise with no confidentiality or availability impact. Publicly available exploit code exists; vendor has not responded to early disclosure.
Server-side request forgery in Dify up to version 1.13.3 allows authenticated remote attackers to manipulate the URL argument in the ApiBasedToolSchemaParser component, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability affects the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Server-side request forgery (SSRF) in Dify's ApiToolManageService allows authenticated remote attackers to manipulate the URL argument in the get_api_tool_provider_remote_schema function, enabling them to make arbitrary HTTP requests from the server. Affects Dify versions up to 0.6.9. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.
Dify versions prior to 1.11.2 contain a stored cross-site scripting vulnerability in Mermaid diagram rendering due to insecure default security configurations, allowing authenticated attackers with user interaction to inject and execute malicious scripts with cross-site impact. Public exploit code exists for this vulnerability, affecting users and developers of the Dify LLM application development platform. A patch is available in version 1.11.2 and later.
Dify versions prior to 1.9.0 leak information through inconsistent API responses that distinguish between registered and non-registered email addresses, enabling attackers to enumerate valid user accounts. Public exploit code exists for this vulnerability, and affected users should upgrade to version 1.9.0 or later to remediate the information disclosure risk.
Dify versions prior to 1.13.0 contain a stored cross-site scripting vulnerability in the chat frontend's echarts integration that executes malicious JavaScript payloads embedded in user or LLM-generated inputs. An attacker can exploit this to perform actions in the context of other users' browsers, potentially stealing session tokens or conducting phishing attacks. Public exploit code exists for this vulnerability, though a patch is available in version 1.13.0 and later.
Plaintext exposure of third-party service API keys in Dify prior to version 1.11.0 allows any authenticated non-administrator user to read those credentials from frontend responses and configuration views, then reuse them against the linked third-party services. Exploitation requires a valid low-privileged account on the instance (CVSS PR:L), so it is not anonymously triggerable, and the practical damage depends on how consequential or quota-limited the leaked keys are - the most likely outcome is unauthorized consumption of paid API quotas and access to external LLM or data services. Publicly available exploit code exists and the issue is fixed in Dify 1.11.0, but EPSS is very low (0.04%, ~13th percentile) and there is no CISA KEV confirmation, so this reads as a real but moderate-priority credential-disclosure issue rather than an emergency.
Dify 1.9.1 permits unauthenticated remote GET requests to the /console/api/system-features console endpoint, letting anonymous clients retrieve system feature configuration that should normally require a logged-in console session (CWE-284, improper access control). The realistic impact is limited and reconnaissance-level rather than secret disclosure: per the upstream fix in PR #31392, the fields improperly exposed were enterprise license status/expiry and workspace limit/usage counters, and these are populated only when ENTERPRISE_ENABLED is true - in a standard non-enterprise deployment the endpoint returns branding, SSO and marketplace flags that are intended to be public. No public exploit identified at time of analysis, and the maintainer disputes the report, stating the endpoint is unauthenticated by design as a dashboard bootstrap mechanism and that no PII, credentials, or secrets are returned. Given the disagreement between the original CVSS 7.5 (C:H) and the narrowed reality of the data actually exposed, this should be triaged as an information-disclosure/hardening issue rather than a high-severity confidentiality breach.
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).
Cross-origin read access to Dify v1.9.1's /console/api/system-features endpoint is possible because the server reflects arbitrary Origin headers while returning Access-Control-Allow-Credentials: true, letting an attacker-controlled web page make credentialed requests in the context of a logged-in console user's browser session. Exploitation requires the victim to hold an active authenticated Dify session and to visit or be redirected to the attacker's page, and the exposure is limited to that single endpoint's data rather than arbitrary API access; the vendor disputes the finding, arguing that credentialed requests provide no more access than unauthenticated ones. No public exploit code was identified at time of analysis, and our independent assessment rates the practical risk far below the 9.1 score assigned in the input, since the realistic worst case is low-confidentiality disclosure requiring user interaction.
Cross-origin information disclosure affects Dify v1.9.1's /console/api/setup endpoint, which reflects any Origin header with Access-Control-Allow-Credentials: true, permitting a malicious external site to issue credentialed requests and read bootstrap setup status from a victim operator's browser. The vendor disputes the finding, stating the endpoint's unauthenticated configuration is intentional for first-time bootstrap in SELF_HOSTED mode and protected by one-time setup guards and init-password validation; our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (low confidentiality, no integrity/availability) because exploitation requires user interaction and the exposed data is limited to pre-setup bootstrap status. No public exploit identified at time of analysis, no CISA KEV entry exists, and no vendor-released patch version is confirmed-PR 32224 only adds documentation notes.
User account enumeration in Dify 1.6.0 allows unauthenticated remote attackers to determine whether a given username or email is registered by analyzing distinct error messages returned during login or registration attempts. This information disclosure (CWE-544) has a CVSS base score of 5.3 and low-priority informational severity, with a publicly available proof-of-concept (EPSS 0.70%, 52nd percentile) but no confirmed active exploitation in CISA KEV. While the flaw itself only reveals account existence, it can facilitate follow-on brute force, credential stuffing, or social engineering campaigns, particularly against internet-facing Dify instances lacking rate-limiting or WAF protections.
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available.
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.
CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
DIFY is an open-source LLM app development platform. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Server-side request forgery in Dify (LangGenius) before 1.13.0 allows unauthenticated remote attackers to make the Dify server fetch attacker-supplied URLs through the /console/api/remote-files/upload (POST) and /remote-files/<path:url> (GET) endpoints, turning the instance into a network pivot against internal services and cloud metadata endpoints. Rated CVSS 3.1 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), the issue is unauthenticated by design - the fix adds @login_required - but practical exploitability is bounded by Dify's existing ssrf_proxy wrapper, which may filter internal or metadata targets depending on allowlist configuration. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor-released patch (1.13.0) is available.
SQL injection in Dify's MyScale vector store backend (versions before 1.16.0-rc1) lets authenticated attackers execute arbitrary SQL against the underlying ClickHouse database by passing unsanitized search parameters into the search_by_full_text method. Because those parameters are concatenated into the query without escaping or parameterization, an attacker can read, modify, or delete stored vector-store data. Publicly available exploit code exists (VulnCheck advisory and GitHub issue #38281) and a vendor patch is available; there is no confirmation of active in-the-wild exploitation.
Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters of arbitrary uploaded files across all tenants and workspaces by submitting the file's UUID to the /console/api/files/{file_id}/preview endpoint. The flaw is amplified on Dify Cloud, where free self-registration makes account creation trivial, and publicly available exploit code exists via the Huntr disclosure. No CISA KEV listing has been recorded at time of analysis, but the combination of low-friction account access and a documented PoC raises practical exposure considerably.
Path traversal in Dify versions 0 through 1.14.1 allows authenticated tenants to escape their authorized tenant path and reach the Plugin Daemon's internal REST API, including debug interfaces, by smuggling unencoded dot sequences through task identifiers or filename parameters. Because Dify Cloud permits unauthenticated free self-registration, the authentication barrier collapses to trivial account creation, and publicly available exploit code exists; the attacker only needs the victim tenant's UUID to pivot. CVSS 4.0 is rated 9.2 with high confidentiality and integrity impact.
Cross-tenant authorization bypass in LangGenius Dify versions through 1.14.1 lets any logged-in editor reroute another tenant's LLM trace traffic - including prompts and model responses - to an attacker-controlled observability provider. Because Dify Cloud permits free self-registration, the authentication barrier is effectively trivial; publicly available exploit code exists and a vendor patch is shipped via PR #35793. The flaw is an instance of CWE-639 (insecure direct object reference) in the trace-configuration endpoints, which accepted an app_id without validating tenant ownership.
Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.
Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.
Server-side template injection (SSTI) in Dify's Jinja2 Handler (versions ≤1.14.2) allows remote, low-privileged authenticated attackers to inject malicious Jinja2 template expressions through the code execution subsystem, resulting in information disclosure and potential further impact. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. The vendor did not respond to responsible disclosure, meaning no patch has been released and no official mitigation guidance exists.
Open redirect in Dify's OAuth flow enables remote attackers to hijack post-authentication redirections, sending users to attacker-controlled sites that can harvest OAuth tokens or credentials. The flaw resides in the AppInitializer component's oauth_redirect_url handling, where the redirect destination is not validated against an allowlist. Exploitation requires user interaction - a target must follow a crafted link - but no authentication is required of the attacker, making phishing-based delivery straightforward. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Dify before version 1.14.0 allows authenticated users to bypass authorization controls and read arbitrary files uploaded by other users within the same tenant by supplying unauthorized file UUIDs in chat-messages API requests. The vulnerability exploits insufficient permission verification on file access endpoints, enabling attackers to circumvent workspace separation and signed URL protections to retrieve sensitive file contents processed through workflows. Publicly available exploit code exists, and a vendor-released patch (version 1.14.0) is available.
Unauthenticated users can upload SVG files containing XSS payloads via POST /api/files/upload in Dify prior to version 1.13.1, allowing cross-site scripting attacks against application users. The authenticated endpoint POST /v1/files/upload is similarly vulnerable. This vulnerability enables attackers to execute arbitrary JavaScript in the context of victim browsers, potentially compromising user sessions or stealing sensitive data without requiring any authentication or user interaction.
Dify prior to version 1.13.1 allows any authenticated user to delete other users' chat histories via the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> endpoint due to insufficient authorization checks. An authenticated attacker can target any conversation ID to perform unauthorized deletion, resulting in data loss for other users. This vulnerability requires valid Dify authentication but no special privileges, affecting all vulnerable versions via network access.
Cross-site scripting in Dify's ImagePreview component (web/app/components/base/image-uploader/image-preview.tsx) allows authenticated users to inject malicious scripts via the filename argument in the openInNewTab function, affecting versions up to 1.13.3. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting impact to low integrity compromise with no confidentiality or availability impact. Publicly available exploit code exists; vendor has not responded to early disclosure.
Server-side request forgery in Dify up to version 1.13.3 allows authenticated remote attackers to manipulate the URL argument in the ApiBasedToolSchemaParser component, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability affects the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Server-side request forgery (SSRF) in Dify's ApiToolManageService allows authenticated remote attackers to manipulate the URL argument in the get_api_tool_provider_remote_schema function, enabling them to make arbitrary HTTP requests from the server. Affects Dify versions up to 0.6.9. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.
Dify versions prior to 1.11.2 contain a stored cross-site scripting vulnerability in Mermaid diagram rendering due to insecure default security configurations, allowing authenticated attackers with user interaction to inject and execute malicious scripts with cross-site impact. Public exploit code exists for this vulnerability, affecting users and developers of the Dify LLM application development platform. A patch is available in version 1.11.2 and later.
Dify versions prior to 1.9.0 leak information through inconsistent API responses that distinguish between registered and non-registered email addresses, enabling attackers to enumerate valid user accounts. Public exploit code exists for this vulnerability, and affected users should upgrade to version 1.9.0 or later to remediate the information disclosure risk.
Dify versions prior to 1.13.0 contain a stored cross-site scripting vulnerability in the chat frontend's echarts integration that executes malicious JavaScript payloads embedded in user or LLM-generated inputs. An attacker can exploit this to perform actions in the context of other users' browsers, potentially stealing session tokens or conducting phishing attacks. Public exploit code exists for this vulnerability, though a patch is available in version 1.13.0 and later.
Plaintext exposure of third-party service API keys in Dify prior to version 1.11.0 allows any authenticated non-administrator user to read those credentials from frontend responses and configuration views, then reuse them against the linked third-party services. Exploitation requires a valid low-privileged account on the instance (CVSS PR:L), so it is not anonymously triggerable, and the practical damage depends on how consequential or quota-limited the leaked keys are - the most likely outcome is unauthorized consumption of paid API quotas and access to external LLM or data services. Publicly available exploit code exists and the issue is fixed in Dify 1.11.0, but EPSS is very low (0.04%, ~13th percentile) and there is no CISA KEV confirmation, so this reads as a real but moderate-priority credential-disclosure issue rather than an emergency.
Dify 1.9.1 permits unauthenticated remote GET requests to the /console/api/system-features console endpoint, letting anonymous clients retrieve system feature configuration that should normally require a logged-in console session (CWE-284, improper access control). The realistic impact is limited and reconnaissance-level rather than secret disclosure: per the upstream fix in PR #31392, the fields improperly exposed were enterprise license status/expiry and workspace limit/usage counters, and these are populated only when ENTERPRISE_ENABLED is true - in a standard non-enterprise deployment the endpoint returns branding, SSO and marketplace flags that are intended to be public. No public exploit identified at time of analysis, and the maintainer disputes the report, stating the endpoint is unauthenticated by design as a dashboard bootstrap mechanism and that no PII, credentials, or secrets are returned. Given the disagreement between the original CVSS 7.5 (C:H) and the narrowed reality of the data actually exposed, this should be triaged as an information-disclosure/hardening issue rather than a high-severity confidentiality breach.
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).
Cross-origin read access to Dify v1.9.1's /console/api/system-features endpoint is possible because the server reflects arbitrary Origin headers while returning Access-Control-Allow-Credentials: true, letting an attacker-controlled web page make credentialed requests in the context of a logged-in console user's browser session. Exploitation requires the victim to hold an active authenticated Dify session and to visit or be redirected to the attacker's page, and the exposure is limited to that single endpoint's data rather than arbitrary API access; the vendor disputes the finding, arguing that credentialed requests provide no more access than unauthenticated ones. No public exploit code was identified at time of analysis, and our independent assessment rates the practical risk far below the 9.1 score assigned in the input, since the realistic worst case is low-confidentiality disclosure requiring user interaction.
Cross-origin information disclosure affects Dify v1.9.1's /console/api/setup endpoint, which reflects any Origin header with Access-Control-Allow-Credentials: true, permitting a malicious external site to issue credentialed requests and read bootstrap setup status from a victim operator's browser. The vendor disputes the finding, stating the endpoint's unauthenticated configuration is intentional for first-time bootstrap in SELF_HOSTED mode and protected by one-time setup guards and init-password validation; our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (low confidentiality, no integrity/availability) because exploitation requires user interaction and the exposed data is limited to pre-setup bootstrap status. No public exploit identified at time of analysis, no CISA KEV entry exists, and no vendor-released patch version is confirmed-PR 32224 only adds documentation notes.
User account enumeration in Dify 1.6.0 allows unauthenticated remote attackers to determine whether a given username or email is registered by analyzing distinct error messages returned during login or registration attempts. This information disclosure (CWE-544) has a CVSS base score of 5.3 and low-priority informational severity, with a publicly available proof-of-concept (EPSS 0.70%, 52nd percentile) but no confirmed active exploitation in CISA KEV. While the flaw itself only reveals account existence, it can facilitate follow-on brute force, credential stuffing, or social engineering campaigns, particularly against internet-facing Dify instances lacking rate-limiting or WAF protections.
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available.
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.
CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
DIFY is an open-source LLM app development platform. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dify is an open-source LLM app development platform. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dify is an open-source LLM app development platform. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.