A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/langgenius/dify/commit/c135ec4b08d946a1a1d3a198a1d72c1ccf47250f | Patch |
| https://huntr.com/bounties/a7eac4ae-5d5e-4ac1-894b-7a8cce5cba9b | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/a7eac4ae-5d5e-4ac1-894b-7a8cce5cba9b - Exploit, Third Party Advisory | |
| References | () https://github.com/langgenius/dify/commit/c135ec4b08d946a1a1d3a198a1d72c1ccf47250f - Patch | |
| First Time |
Langgenius dify
Langgenius |
|
| CPE | cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:41
NVD link : CVE-2025-0184
Mitre link : CVE-2025-0184
JSON object : View
Products Affected
langgenius
- dify
CWE
CWE-918
Server-Side Request Forgery (SSRF)