CVE-2025-0184: Server-Side Request Forgery (SSRF) in langgenius/dify
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrfproxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
langgenius/difyto a version that resolves this vulnerability.Fixed in 0.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0184?
CVE-2025-0184 is categorized as a medium severity Server-Side Request Forgery (SSRF) vulnerability.
How do I fix CVE-2025-0184?
To fix CVE-2025-0184, upgrade langgenius/dify to version 0.11.0 or later.
What versions of langgenius/dify are affected by CVE-2025-0184?
Versions of langgenius/dify prior to 0.11.0 are affected by CVE-2025-0184.
What type of vulnerability is CVE-2025-0184?
CVE-2025-0184 is a Server-Side Request Forgery (SSRF) vulnerability.
In which section of langgenius/dify does CVE-2025-0184 occur?
CVE-2025-0184 occurs in the 'Create Knowledge' section when uploading DOCX files.