PT-2025-18093 · Dify · Dify

H0J3N + 1 · Published 2025-04-28 · Updated 2025-04-28 · CVE-2025-43854

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DIFY versions prior to 1.3.0

Description A clickjacking issue was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 to resolve the issue.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-43854

GHSA-JHGQ-CX3F-VJ5P

Affected Products

Dify

References · 9

• 🔥 https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43854.json · Exploit
• https://github.com/langgenius/dify/pull/18516 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-43854 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43854 · Vendor Advisory
• https://t.me/cvedetector/23921 · Telegram Post
• https://t.me/cvetracker/22542 · Telegram Post
• https://twitter.com/CVEnew/status/1916889668810932717 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1916903116861067424 · Twitter Post