Is CVE-2026-41948 actively exploited?

No active exploitation of CVE-2026-41948 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41948 be exploited remotely?

Yes. CVE-2026-41948 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41948?

CVE-2026-41948 has a CVSS score of 9.4 (CRITICAL).

HOME VULNERABILITIESCVE-2026-41948

CRITICAL

CVE-2026-41948

CWE-23Published: May 18, 2026· Updated: May 19, 2026

9.4

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:18.7th

Official Description

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

NVD Source

Risk Analysis

This critical path traversal vulnerability in Dify allows authenticated users to access internal REST API endpoints. By manipulating URL paths with unencoded dot sequences, attackers can bypass authorization and access sensitive interfaces. With a CVSS score of 9.4, this is a serious concern, especially since Dify Cloud allows easy account creation.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable and requires authentication, though Dify Cloud's free self-registration makes obtaining credentials trivial.

Recommended Action

Upgrade Dify to a version beyond 1.14.1 to address the path traversal vulnerability. Implement robust input validation and URL path sanitization to prevent traversal attacks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-41948 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.4.