PT-2026-41675 · Dify · Dify

Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-41948

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.14.2

Description Insufficient URL path sanitization allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API. By using unencoded dot sequences in task identifiers or manipulated filename parameters, attackers can perform path traversal to exit their authorized tenant path. This enables access to internal endpoints, such as debug interfaces, provided the attacker knows the victim tenant's UUID. Dify Cloud facilitates this by allowing unauthenticated free self-registration.

Recommendations Update to a version later than 1.14.1.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-41948

Affected Products

Dify

References · 8

• 🔥 https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0 · Exploit
• https://github.com/langgenius/dify/pull/35796 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41948 · Security Note
• https://t.me/CVEtracker/54134 · Telegram Post
• https://twitter.com/vuldb/status/2056702051036631092 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2056402255402631327 · Twitter Post
• https://twitter.com/UpwindMDR/status/2056403788378853584 · Twitter Post
• https://vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access · Note