Server-Side Request Forgery Vulnerability in Dify by Langgenius

CVE-2025-0184

What is CVE-2025-0184?

A vulnerability was found in Dify, a product by Langgenius, where a Server-Side Request Forgery (SSRF) could be exploited through the 'Create Knowledge' feature. This issue arises during the upload of DOCX files that contain external relationships, which, due to improper handling, allow URLs to be requested directly via the 'requests' module instead of routing through the 'ssrf_proxy'. This oversight poses a risk of exposing sensitive information or facilitating unauthorized access. The vulnerability was addressed and resolved in version 0.11.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References