취약점 이력이 말해 주는 것
이 소프트웨어에는 최고 CVSS 점수 9.8의 기록된 CVE가 41개 있으며, KEV 데이터베이스에 보고된 건수는 0개입니다.
안전하게 운영하려면
운영자는 설치 항목을 지원되는 릴리스 라인으로 최신 상태로 유지하고 설치된 소프트웨어 버전을 정기적으로 추적해야 합니다.
영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-58141 | Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints | ≥ 0.6.0 < 1.15.0 | 7.2 | — | 2026-11-07 | |
| CVE-2026-123135 | langgenius dify Sandbox Run __init__.py hard-coded credentials | = 1.0 = 1.1 = 1.2 | 5.3 | — | 2026-11-06 | |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint | * | 8.3 | — | 2026-10-06 | |
| CVE-2026-105761 | Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers | * | 7.1 | — | 2026-10-06 | |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | = 1.13.0 | 5.1 | — | 2026-09-03 | |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | = 1.13.0 | 5.3 | — | 2026-09-03 | |
| CVE-2026-18632 | langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine | = 1.14.0 = 1.14.1 = 1.14.2 | 5.3 | — | 2026-08-04 | |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability | = 1.11.4 | 5.4 | — | 2026-07-30 | |
| CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text | < 1.16.0-rc1 | 8.7 | — | 2026-07-11 | |
| CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview Endpoint | < 1.14.2 | 8.2 | — | 2026-05-18 | |
| CVE-2026-41948 | Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access | ≤ 1.14.1 | 9.3 | — | 2026-05-18 | |
| CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints | < 1.14.2 | 9.3 | — | 2026-05-18 | |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUID | < 1.14.0 | 6.0 | — | 2026-05-06 | |
| CVE-2026-42138 | Dify Vulnerable to Stored XSS via SVG-file upload | * | 6.9 | — | 2026-05-05 | |
| CVE-2026-34082 | Dify has IDOR in deleting someone else's chat conversation | * | 5.3 | — | 2026-04-21 | |
| CVE-2026-6619 | langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting | = 1.13.0 = 1.13.1 = 1.13.2 | 5.1 | — | 2026-04-20 | |
| CVE-2026-6618 | langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request... | = 1.13.0 = 1.13.1 = 1.13.2 | 5.3 | — | 2026-04-20 | |
| CVE-2026-6617 | langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-si... | = 0.6.0 = 0.6.1 = 0.6.2 | 5.3 | — | 2026-04-20 | |
| CVE-2026-21866 | Dify - Stored XSS in chat | * | 5.1 | — | 2026-03-04 | |
| CVE-2026-28288 | Dify has a user enumeration issue | * | 5.5 | — | 2026-02-28 | |
| CVE-2026-26023 | Client‑side DOM XSS in the web chat app of Dify when using echarts | * | 5.3 | — | 2026-02-12 | |
| CVE-2025-67732 | Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint | * | 8.4 | — | 2026-01-06 | |
| CVE-2025-63387 | Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests t... | * | 4.3 | — | 2025-12-18 | |
| CVE-2025-63386 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/ap... | * | 9.1 | — | 2025-12-18 | |
| CVE-2025-63388 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/ap... | * | 9.1 | — | 2025-12-18 | |
| CVE-2025-56157 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml... | * | 9.8 | — | 2025-12-18 | |
| CVE-2025-58747 | Dify MCP OAuth Flow Vulnerable to XSS | * | 2.0 | — | 2025-10-18 | |
| CVE-2025-56520 | Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.conso... | * | 5.3 | — | 2025-09-30 | |
| CVE-2025-59422 | Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others | * | 6.0 | — | 2025-09-25 | |
| CVE-2025-3467 | XSS Vulnerability in langgenius/dify | * | 8.0 | — | 2025-07-07 | |
| CVE-2025-3466 | Unsanitized Input in langgenius/dify | * | 9.8 | — | 2025-07-07 | |
| CVE-2025-49149 | Dify has XSS vulnerability | * | 5.3 | — | 2025-06-18 | |
| CVE-2025-43854 | DIFY vulnerable to Clickjacking Attack | * | 2.3 | — | 2025-04-29 | |
| CVE-2025-43862 | Dify Allows Unauthorized Access and Modification of APP Orchestration | * | 7.6 | — | 2025-04-26 | |
| CVE-2025-32796 | Dify Allows Unauthorized APP Enable/Disable via API | * | 6.5 | — | 2025-04-19 | |
| CVE-2025-32795 | Dify Allows Insecure User Role Access Control for APP Editing | * | 6.5 | — | 2025-04-19 | |
| CVE-2025-32790 | Dify Allows Insecure User Role Access Control for APP DSL Exporting | * | 6.3 | — | 2025-04-18 | |
| CVE-2025-29720 | Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console... | * | 4.8 | — | 2025-04-14 | |
| CVE-2025-0184 | Server-Side Request Forgery (SSRF) in langgenius/dify | * | 6.5 | — | 2025-03-20 | |
| CVE-2024-10252 | Code Injection in langgenius/dify | * | 8.8 | — | 2025-03-20 | |
| CVE-2024-11824 | Stored XSS in langgenius/dify | * | 5.8 | — | 2025-03-20 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).