CVE-2026-41948

Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

No known exploitation. EPSS puts it in the 79th percentile. Only a workaround so far.

CVSS 3.19.4Critical EPSS percentile79th1.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-05-18Updated 2026-06-22Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check whether you are running dify version 1.14.1 or earlier.
Confirm whether the Plugin Daemon / plugin internal API endpoints are enabled and reachable from your users or networks.
Review who has access to your Dify instance (especially any users who could reach the affected API routes).
Apply the fix referenced by the Dify project (upgrade per the vendor’s release notes that include the referenced pull request).
Until you can upgrade, restrict network access to Dify (especially the Plugin Daemon and any internal/admin-style endpoints) so only trusted networks/users can reach them.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

In plain language

Written by AI from the record

CVE-2026-41948 is a path-traversal flaw in Dify v1.14.1 and earlier that can let an attacker use a specially crafted request to reach internal Dify features; it’s mainly a risk if someone already has an account in your Dify setup, so you should update and restrict access.

In dify (CVE-2026-41948), a path traversal issue (CWE-23) in the Plugin Daemon internal API routing allows crafted URL paths to escape tenant-scoped paths and access internal endpoints by insufficient URL path sanitization; exploitation requires no special user interaction and does not require authentication according to the core finding, but the patch guidance indicates tenant/route access is part of the trigger conditions.

If you're affected

Internal feature or debug access
Cross-tenant data exposure
System manipulation from tenant
Service disruption risk

What is it

This vulnerability lets an attacker “trick” Dify into looking at the wrong internal web address, by putting special characters in the URL path. If successful, they may be able to reach internal Dify functions that are not meant to be available through that normal route—like hidden/debug-style features or parts of other tenants.
Think of it like giving someone the ability to file paperwork using a misleading address, so it gets routed past your intended office boundaries.

Who is affected

This matters if you run dify (Dify) version 1.14.1 or earlier and you have the Plugin Daemon / plugin-related internal API routing enabled. The findings indicate the issue can be triggered over the network with no user interaction, and it is described as not requiring authentication in the core analysis.
However, the practical risk depends on whether an attacker can reach the affected endpoints/routes in your environment (for example, whether those internal paths are exposed to users on your network or via a public interface).

How urgent is it

This is an AMBER issue: the vulnerability is serious (it can reach internal endpoints and potentially bypass tenant boundaries), but there is no confirmed KEV listing and no clear dated reporting of real-world exploitation in the findings provided. Treat it as a high-priority patch/update because the flaw is network-reachable and requires no special user interaction once an attacker can access the relevant routes.

What to do — in detail

Confirm exposure

Determine your exact Dify version. If it is dify v1.14.1 or earlier, you should assume exposure.
Identify whether Plugin Daemon / plugin internal API endpoints are enabled in your deployment.
Confirm how your instance is exposed:
- Public internet vs. restricted network
- Which routes are reachable from authenticated users (and whether any internal/admin-style endpoints are reachable through normal browsing/API access)

Get the fixed version

The vendor-provided fix is referenced via upstream PR: https://github.com/langgenius/dify/pull/35796
The findings note there is no clean fixed-version string in the data provided; the exact fixed release version should be confirmed from the Dify vendor release notes or the PR’s merged commits.

Upgrade plan (recommended)

Schedule a maintenance window.
Upgrade dify to the specific release version that includes the fix from https://github.com/langgenius/dify/pull/35796.
After upgrading:
- Re-check that the Plugin Daemon/plugin internal endpoints behave normally.
- Validate that tenant-scoped access cannot be bypassed via crafted paths.

Workaround if patching is delayed

Restrict network access so the Plugin Daemon and any internal/plugin routes are reachable only from trusted networks (or only via your intended app front-end), not directly from the public internet.
Apply least-privilege access control for users who can interact with Dify features that would route requests toward the Plugin Daemon.

What to monitor

Look for unusual requests targeting plugin/internal API routes, especially URL paths containing unexpected dot-sequences or encoded path traversal patterns.
Review logs for repeated 4xx/5xx errors around plugin/internal endpoints (often an indicator of path probing).

KEV / timeline

No KEV listing was provided for this CVE, so there is no CISA due date included in the findings.

Technical context

Severity is reflected by the provided CVSS of 9.4, driven by network access with no special privileges stated, and potential impact to confidentiality and integrity. The weakness is CWE-23 (Path Traversal).

Mechanism: insufficient sanitization of URL paths allows an attacker to manipulate request paths that are forwarded to the Plugin Daemon internal REST API, escaping tenant-scoped paths using crafted path elements (e.g., unencoded dot sequences or manipulated filename parameters). This can enable access to internal endpoints, including debug-style interfaces.

Exploit status from findings: no KEV listing, no clear dated press claim of exploitation, and no public exploit code on record. Patch availability: a fix is referenced via upstream PR https://github.com/langgenius/dify/pull/35796, but the findings state there is no clean fixed-version string (so the exact fixed version must be verified on the vendor release page).

Predicted likelihood: an EPSS prediction exists in the findings, but because KEV/news do not confirm exploitation here, the urgency is driven primarily by the direct technical impact and the high severity rather than exploitation-maturity evidence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS79th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.9% chance of exploitation activity in the next 30 days, which ranks it in the 79th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

unknown.

Real risk signals with little public attention so far.

Lifecycle

12 events over 129 days, from the signal feeds we watch.

2026-09-24EPSS band changemoderate → lowepss band change
2026-09-19EPSS band changelow → moderate
2026-09-18EPSS band changelow → moderate
2026-09-15EPSS band changelow → moderateepss band change, nuclei check added
2026-06-22Workaround availablerecord updated
2026-05-18Publishedweakness classified, att&ck mapped

Affected products

difycommercial
- difySaaSAI / ML / llm-serving-inference
langgeniusoss-projectaka dify, langgenius/dify
- difyMixedAI / ML / llm-serving-inference

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Scored 9.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability LowReduced performance or intermittent disruption of service