Description
在 Dify v1.0 中发现了一个服务器端请求伪造（Server-Side Request Forgery, SSRF）漏洞，该漏洞位于`controllers.console.remote_files.RemoteFileUploadApi` 组件。
Dify存在SSRF漏洞（CVE-2025-29720）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-29720
https://access.redhat.com/security/cve/cve-2025-29720
https://www.cve.org/CVERecord?id=CVE-2025-29720
https://cve.imfht.com/detail/CVE-2025-29720
https://github.com/cisagov/vulnrichment/blob/develop/2025/29xxx/CVE-2025-29720.json
https://www.cvedetails.com/cve/CVE-2025-29720/
https://www.tenable.com/cve/CVE-2025-29720
https://www.ddpoc.com/DVB-2025-9723.html