CVE-2025-0184
Server-Side Request Forgery (SSRF) in langgenius/dify
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Server-Side Request Forgery (SSRF) in langgenius/dify
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.
Reserved 2025-01-02 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-918 Server-Side Request Forgery (SSRF)
huntr.com/bounties/a7eac4ae-5d5e-4ac1-894b-7a8cce5cba9b
github.com/...ommit/c135ec4b08d946a1a1d3a198a1d72c1ccf47250f
Support options
