CVE-2026-42138: Dify Vulnerable to Stored XSS via SVG-file upload
Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
difyto a version that resolves this vulnerability.Fixed in 1.13.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42138?
The severity of CVE-2026-42138 is classified as high due to the potential for stored XSS attacks.
How do I fix CVE-2026-42138?
To fix CVE-2026-42138, update to Dify version 1.13.1 or later.
Who is affected by CVE-2026-42138?
Any user of Dify versions prior to 1.13.1 is affected by CVE-2026-42138.
What type of attack is associated with CVE-2026-42138?
CVE-2026-42138 is associated with stored XSS attacks via SVG-file uploads.
Can unauthenticated users exploit CVE-2026-42138?
Yes, unauthenticated users can exploit CVE-2026-42138 by uploading malicious SVG files.