CVE-2026-105762: CWE-918: Server-Side Request Forgery (SSRF) in langgenius dify
Description
Dify, an open-source LLM app development platform, had a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 1.13.0. The vulnerability existed in the /console/api/remote-files/upload endpoint, which accepted attacker-controlled URLs without authentication, allowing the server to make arbitrary requests. This could enable remote attackers to access internal services or cloud metadata endpoints, potentially exposing sensitive data and enabling network pivoting. The issue is fixed in version 1.13.0.
CVSS v3.1
Score 8.3high
Affected software
langgenius
dify
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105762 is a Server-Side Request Forgery (SSRF) vulnerability in the langgenius dify platform. Specifically, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted URLs controlled by unauthenticated attackers, causing the server to fetch these URLs. This flaw could be exploited to send requests to internal network services or cloud metadata endpoints, risking exposure of sensitive information and enabling the attacker to pivot within the network. The vulnerability is resolved in dify version 1.13.0.
Potential Impact
Exploitation of this SSRF vulnerability could allow an unauthenticated remote attacker to make the dify server perform arbitrary HTTP requests to internal or cloud metadata services. This can lead to information disclosure of sensitive internal resources and potentially enable further attacks by using the server as a pivot point within the network. The CVSS 3.1 score is 8.3 (high severity), indicating significant confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Upgrade dify to version 1.13.0 or later, where this SSRF vulnerability is fixed. No other mitigations are specified or required once the official fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T19:11:07.948Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac433e22cdf04f6564738d4
Added to database: 10/05/2026, 23:33:54 UTC
Last enriched: 10/05/2026, 23:48:25 UTC
Last updated: 10/05/2026, 23:48:59 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.