SB20260727384 - Multiple vulnerabilities in Dify

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-42138)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the file upload handling and served uploaded SVG content when processing uploaded SVG files. A remote attacker can upload a specially crafted SVG file and lure a victim into following the returned source_url to execute arbitrary script in a victim's browser.

The uploaded file can be retrieved through the returned source_url without authentication.

2) Improper access control (CVE-ID: CVE-2026-34082)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to delete another user's chat conversation.

The vulnerability exists due to improper access control in the DELETE /console/api/installed-apps//conversations/ endpoint when handling crafted deletion requests for a conversation identifier. A remote user can send a specially crafted request with a known conversationId to delete another user's chat conversation.

Exploitation requires authentication, and any role is sufficient. Knowledge of the target conversation GUID is required.

Remediation

Install update from vendor's website.

References

• https://github.com/langgenius/dify/security/advisories/GHSA-cg94-8v83-7hjj
• https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p