CVE-2025-29720 - Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi

MEDIUM

Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi

Published Apr 14, 2025

4.8

MEDIUM

CVSS 3.1

EPSS 0.17%

Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

Link	Providers	Tags
https://dify.ai		Product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14819		Advisory
https://github.com/langgenius/dify/issues/15185		ExploitIssue TrackingVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 14, 2025

Updated Apr 14, 2025

Reserved Mar 11, 2025

CISA Vulnrichment

Updated Apr 14, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Apr 14, 2025

Updated Apr 14, 2025

GitHub

No data