PT-2025-17294 · Dify · Dify

H0J3N + 1 · Published 2025-04-18 · Updated 2025-04-18 · CVE-2025-32790

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dify versions 0.6.8 and prior

Description A vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in "/export" should only allow administrator users to export DSL.

Recommendations For versions 0.6.8 and prior, update the access control mechanisms to enforce stricter user role permissions and implement role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. Update to version 0.6.13 to fix the vulnerability.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-32790

GHSA-JP6M-V4GW-5VGP

Affected Products

Dify

References · 9

• 🔥 https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32790.json · Exploit
• https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246 · Patch
• https://github.com/langgenius/dify/pull/5841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32790 · Security Note
• https://t.me/cvetracker/21921 · Telegram Post
• https://twitter.com/CVEnew/status/1913312947742671294 · Twitter Post
• https://t.me/cvedetector/23325 · Telegram Post