Cyber Posture

CVE-2026-41948

HighPublic PoC

Published: 18 May 2026

Published
18 May 2026
Modified
19 May 2026
KEV Added
—
Patch
—
CVSS Score 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0006 17.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41948 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Dify Dify. Its CVSS base score is 7.7 (High).

Operationally, ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

NVD Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path…

more

using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-23

Affected Products

dify
dify
≤ 1.14.1

References