CVE-2026-105762

Published: Oct 6, 2026Modified: Oct 6, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.7

Source: security-advisories@github.com (Secondary)

Description

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/langgenius/dify/commit/2f87ecc0ce1d05ab3ef9537f29b84a5fa5823017

Source: security-advisories@github.com

https://github.com/langgenius/dify/pull/32236

Source: security-advisories@github.com

https://github.com/langgenius/dify/releases/tag/1.13.0

Source: security-advisories@github.com

https://github.com/langgenius/dify/security/advisories/GHSA-8235-vv5j-mmvg

Source: security-advisories@github.com

https://github.com/langgenius/dify/security/advisories/GHSA-8235-vv5j-mmvg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.