CVE-2026-41948

Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: CRITICAL
CVSS score: 9.2 / 10
CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Effective score: 9.2 / 10 CRITICAL source: CNA overview
CWE(s): CWE-23
Reserved: 2026-04-22
Published: 2026-05-18 13:50 UTC
Last updated: 2026-05-18 14:38 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41948.json
Linked Threat: CVE-2026-41948 — Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-18 15:16:25 UTC
NVD last modified: 2026-05-19 19:25:04 UTC
NVD CVSS v3.1: 7.7 / 10 HIGH source: disclosure@vulncheck.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploitability subscore: 2.2 / 10
Impact subscore: 5.5 / 10
EPSS score: 0.0008 (probability of exploitation in next 30 days)
EPSS percentile: 23.23% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-30771
Assigner: VulnCheck
Published: May 18, 2026, 1:50:21 PM
Updated: May 26, 2026, 4:07:59 PM
EUVD base score (CVSS 4.0): 9.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0800
Vendors: langgenius
Products: dify (0 ≤1.14.1)
Aliases: GHSA-h666-98mq-949j

ENISA description: Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
langgenius	dify	`0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0 technical-descriptionexploit
https://github.com/langgenius/dify/pull/35796 issue-tracking
https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access third-party-advisory

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps technical-description, exploit

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0 tenable:huntr.com
https://nvd.nist.gov/vuln/detail/CVE-2026-41948 tenable:nvd.nist.gov
https://github.com/langgenius/dify/pull/35796 tenable:github.com
https://www.first.org/epss/ tenable:www.first.org
https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access tenable:www.vulncheck.com
https://www.cve.org/CVERecord?id=CVE-2026-41948 tenable:www.cve.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/langgenius/dify/pull/35796 disclosure@vulncheck.com Issue TrackingMitigationPatch
https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0 disclosure@vulncheck.com ExploitThird Party Advisory
https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access disclosure@vulncheck.com Third Party Advisory

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

Mitigation Under Binding Operational Directive (BOD) 22-01, all federal civilian executive branch (FCEB) agencies are mandated to apply vendor-provided mitigations by June 3, 2026 , or discontinue use of the affected product if patches are unavailable. CISA's guidance explicitly extends to cloud-hosted environments leveraging Microsoft Defender.

2026-05-22 19:21 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-22 19:21 UTC
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

2026-05-22 19:21 UTC
Microsoft Patch Tuesday - May 2026 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday May 2026 summary.

2026-05-22 19:21 UTC
CVE-2026-41948 - Dify v1.14.1 Path Traversal via Plugin Daemon Internal ...

web:cvefeed.io

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename …

2026-05-22 19:21 UTC
CVE-2026-41948 - Exploits & Severity - Feedly

web:feedly.com

Mitigation Upgrade Dify to a version later than 1.14.1. Implement strict input validation and URL path sanitization for all Plugin Daemon API requests. Restrict access to internal endpoints and debug interfaces. Consider implementing network-level controls to limit access to the Plugin Daemon from trusted sources only.

2026-05-22 19:21 UTC
CVE-2026-41948 - Vulnerability Details - OpenCVE

web:app.opencve.io

No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade Dify to version 1.14.2 or later to remove the path traversal vulnerability. Implement strict input validation on Plugin Daemon internal API endpoints, rejecting unencoded dot sequences and ensuring the request path remains within the tenant context. Restrict or disable exposed debug interfaces and other ...

2026-05-22 19:21 UTC
Microsoft Patches Two Actively Exploited Defender Zero-Days on Windows

web:windowsreport.com

Microsoft has released emergency security updates for two actively exploited zero-day vulnerabilities affecting Microsoft Defender components on Windows systems. The patches started rolling out on Wednesday, and both flaws are already under active exploitation.

2026-05-22 03:12 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 03:12 UTC
CVE-2026-41948: Dify version 1.14.1 anDirectory traversal -

web:www.sherlockforensics.com

Dify version 1.14.1 and directory traversal ( CVE-2026-41948 ) scores CVSS 7.7 HIGH. Analysis of affected systems and remediation steps.

2026-05-22 03:12 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-22 03:12 UTC
CVE-2026-41948 - Overview, Insights & Trends

web:cvemon.intruder.io

Get the latest on CVE-2026-41948 , including risk score and recommendations. Vulnerability intelligence on trending CVEs from multiple sources.

2026-05-22 03:12 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-05-22 03:12 UTC
CVE-2026-41948 - GitHub Advisory Database

web:github.com

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal ...

2026-05-22 03:12 UTC
Nvd - Cve-2026-41948

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-22 03:12 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 03:12 UTC
Android Security Bulletins - Android Open Source Project

web:source.android.com

This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.

2026-05-22 03:12 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-41948.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41948",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T14:38:43.720028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T14:38:57.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "dify",
          "vendor": "langgenius",
          "versions": [
            {
              "lessThanOrEqual": "1.14.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ido Shani and Gal Zaban of Zafran Security"
        }
      ],
      "datePublic": "2026-03-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-18T14:04:09.832Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/langgenius/dify/pull/35796"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-41948",
    "datePublished": "2026-05-18T13:50:21.372Z",
    "dateReserved": "2026-04-22T18:50:43.622Z",
    "dateUpdated": "2026-05-18T14:38:57.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}