CVE-2026-41948: Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.14.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41948?
CVE-2026-41948 is categorized as a high severity vulnerability due to its potential for unauthorized access and manipulation of internal API calls.
How do I fix CVE-2026-41948?
To fix CVE-2026-41948, upgrade Dify to version 1.14.2 or later which contains the necessary patches.
Who is affected by CVE-2026-41948?
CVE-2026-41948 affects Dify version 1.14.1 and prior, impacting any installations running those versions.
What type of vulnerability is CVE-2026-41948?
CVE-2026-41948 is a path traversal vulnerability that allows attackers to exploit insufficient URL path sanitization.
Can authenticated users exploit CVE-2026-41948?
Yes, authenticated users can exploit CVE-2026-41948 by manipulating requests to the Plugin Daemon's internal REST API.