cvedb.io
CVE-2026-41948
CRITICAL · CVSS 9.4
EPSS exploitation probability: 0%
Published 2026-05-18T15:16:25.977 · Last modified 2026-06-22T18:16:37.033

Summary

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Affected products

dify — dify

Does this affect you?

Add your gear to cvedb and we'll alert you only when dify ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.