Dify - Path Traversal (CVE-2026-41948)

CVE-2026-41948 is a critical path traversal vulnerability in Dify 1.14.1 and earlier that allows attackers to manipulate requests sent to the Plugin Daemon’s internal REST API. By using unencoded dot sequences in task identifiers or crafted filename parameters, attackers can escape tenant-specific paths and access restricted internal endpoints, potentially enabling unauthorized data access, code execution, or service disruption. Although authentication is generally required, Dify Cloud’s free self-registration can make account creation readily accessible to attackers.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-41948 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the unauthenticated /console/api/workspaces/current/plugin/icon endpoint and use the filename parameter with dot-sequence traversal such as ../../../health/check to escape the intended plugin asset path. Successful requests reach internal Plugin Daemon endpoints and may expose health, version, and pool-status metadata.