Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-41948 is a vulnerability classified as Relative Path Traversal, affecting dify (affected versions: ≤ 1.14.1). This vulnerability is rated Critical, with a CVSS score of 9.3. Public exploit code or evidence is available for this vulnerability, but that does not confirm exploitation in the wild.
Analyzing data...
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
