CVE-2026-41948— Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| langgenius | dify | ≤ 1.14.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41948
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
Source: NVD (National Vulnerability Database)
Vulnerability Description
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
相对路径遍历
Source: NVD (National Vulnerability Database)
Vulnerability Title
dify 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dify是LangGenius开源的一个 LLM 应用程序开发平台。 dify 1.14.1及之前版本存在安全漏洞，该漏洞源于路径遍历问题，可能导致认证用户通过利用不充分的URL路径清理来操纵转发到插件守护进程内部REST API的请求。攻击者可以使用任务标识符中未编码的点序列或操纵的文件名参数遍历出授权租户路径，访问内部端点如调试接口。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| langgenius | dify | 0 ~ 1.14.1 | - |
II. Public POCs for CVE-2026-41948
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41948
请登录查看更多情报信息。
- https://github.com/langgenius/dify/pull/35796issue-tracking
- https://nvd.nist.gov/vuln/detail/CVE-2026-41948
Same Patch Batch · langgenius · 2026-05-18 · 3 CVEs total
| CVE-2026-41947 | 7.4 HIGH | Dify v1.14.1 Authorization Bypass via Trace Configuration Endpoints |
| CVE-2026-41949 | 5.9 MEDIUM | Dify v1.14.1 Authorization Bypass via File Preview Endpoint |
IV. Related Vulnerabilities
Same product: dify
- CVE-2026-41949
Dify v1.14.1 Authorization Bypass via File Preview Endpoint - CVE-2026-41947
Dify v1.14.1 Authorization Bypass via Trace Configuration En - CVE-2026-41950
Dify < 1.14.0 Authorization Bypass via File UUID - CVE-2026-42138
Dify Vulnerable to Stored XSS via SVG-file upload - CVE-2026-34082
Dify has IDOR in deleting someone else's chat conversation
Same vendor: langgenius
- CVE-2026-41949
Dify v1.14.1 Authorization Bypass via File Preview Endpoint - CVE-2026-41947
Dify v1.14.1 Authorization Bypass via Trace Configuration En - CVE-2026-41950
Dify < 1.14.0 Authorization Bypass via File UUID - CVE-2026-42138
Dify Vulnerable to Stored XSS via SVG-file upload - CVE-2026-34082
Dify has IDOR in deleting someone else's chat conversation
V. Comments for CVE-2026-41948
No comments yet