vulncheck.comadvisory

Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

VulnCheck advisory details a path traversal vulnerability in Dify v1.14.1 and prior, where insufficient URL path sanitization lets authenticated users manipulate requests forwarded to the Plugin Daemon's internal REST API. Using unencoded dot sequences in task identifiers or manipulated filename parameters, an attacker who knows a victim tenant's UUID can traverse outside their authorized tenant path to reach internal endpoints such as debug interfaces. The advisory notes Dify Cloud's open self-registration makes obtaining an authenticated account trivial, lowering the exploitation bar.