Executive brief
Dify, an open-source platform for building AI applications, contains a security flaw in how it handles internal requests between its components. An attacker with a standard account can bypass security boundaries to access restricted internal interfaces, potentially leading to unauthorized data access or system manipulation. Because Dify Cloud allows anyone to register for a free account, this vulnerability is easily accessible to external actors.
Technical details
A path traversal vulnerability exists in Dify's `BasePluginClient._prepare_request` component due to insufficient sanitization of URL paths before they are forwarded to the Plugin Daemon's internal REST API. By using unencoded dot sequences (e.g., ".." or "%2e%2e") in task identifiers or filename parameters, an authenticated attacker can escape the authorized tenant path. This allows access to internal endpoints, such as debug interfaces, provided the attacker knows the target tenant's UUID. While the vulnerability requires authentication, the risk is elevated by the fact that Dify Cloud supports open self-registration. A fix involving path decoding and segment validation was introduced in pull request #35796.
Affected products
- LangGenius Dify <= 1.14.1
Timeline
- 2026-05-05: other: Fix pull request submitted to GitHub
- 2026-05-18: disclosed: Vulnerability disclosed by VulnCheck and NVD