CVE-2026-41948: langgenius dify vulnerability

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Exploitation

Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.

CISA KEV

Not listed

Public check

Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal · nuclei template in projectdiscovery/nuclei-templates

Weakness

Relative Path Traversal · File and Path Handling

Vendor

langgenius

Published

May 2026

Band

Check available, not yet exploited, May 2026

• NVD entrynvd.nist.gov
• Vendor advisorygithub.com
• CVE recordcve.org
• Weakness CWE-23cwe.mitre.org