Description
Dify 是一款开源的、基于大型语言模型（LLM）的应用开发平台。Dify v1.6.0 包含一个服务器端请求伪造漏洞，由 controllers.console.remote_files.RemoteFileUploadApi 中的验证不当引起，允许攻击者从服务器发起任意请求，利用该漏洞需要网络访问权限。
Dify /console/api/remote-files/ 服务器端请求伪造漏洞（CVE-2025-56520）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-56520
https://avd.aliyun.com/detail?id=AVD-2025-56520
https://cve.imfht.com/detail/CVE-2025-56520
https://www.crowdsec.net/vulntracking-report/cve-2025-56520
https://cloud.projectdiscovery.io/library/CVE-2025-56520
https://access.redhat.com/security/cve/cve-2025-56520
https://github.com/advisories/GHSA-x284-mqwh-m8wm
https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-56520
https://app.opencve.io/cve/?vendor=dify