PT-2025-12301 · Unknown+1 · Langgenius/Dify+1

Johnjyong · Published 2025-03-20 · Updated 2025-03-20 · CVE-2025-0184

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.10.2

Description A Server-Side Request Forgery (SSRF) issue was identified in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the requests module instead of the ssrf proxy, leading to an SSRF issue.

Recommendations For version 0.10.2, update to version 0.11.0 to resolve the issue. As a temporary workaround, consider restricting the upload of DOCX files with external relationships or disabling the 'Create Knowledge' section until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-0184

Affected Products

Langgenius/Dify

Requests

References · 7

• 🔥 https://huntr.com/bounties/a7eac4ae-5d5e-4ac1-894b-7a8cce5cba9b · Exploit
• https://github.com/langgenius/dify/commit/c135ec4b08d946a1a1d3a198a1d72c1ccf47250f · Patch
• https://osv.dev/vulnerability/CVE-2025-0184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0184 · Security Note
• https://t.me/cvetracker/19506 · Telegram Post
• https://t.me/cvedetector/20726 · Telegram Post
• https://twitter.com/CVEnew/status/1902670960177603070 · Twitter Post