Dashboard / CVE-2026-41948

CVE-2026-41948

CRITICAL
HIGH Priority: 2.11 BB Relevance: 83/100
Published: 2026-05-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: High
VA: Low

Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langgenius dify 0

References & Advisories (4)

Bug Bounty Relevance

83 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

22.71%
Raw Score 0.227070
Percentile 97.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.22707
2026-11-12
0.22707
2026-11-10
0.22707
2026-11-09
0.22707
2026-11-08
0.22707

Intelligence Sources

mitre ref →

External Links