A relative path traversal vulnerability in Dify allows potential unauthorized access to sensitive internal data through the plugin daemon API.

This vulnerability is a Relative Path Traversal (CWE-23) flaw. It allows an unauthenticated attacker to interact with the plugin daemon's internal API, potentially leading to unauthorized access to cross-tenant data.

The ability to access data across different tenants on a platform is a critical security failure, leading to massive potential for data leakage and loss of customer trust. With a CVSS score of 7.7, this vulnerability poses a severe risk to multi-tenant environments where data isolation is a primary security requirement.

Immediate Action: Check the vendor's official GitHub repository for the latest security release and apply it immediately; if no patch is available, restrict network access to the Dify plugin daemon.

Proactive Monitoring: Monitor API logs for unusual request patterns targeting the plugin daemon, specifically those containing path traversal sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts and unauthorized calls to internal API endpoints.

Public Exploit Available: Unknown.

Given the critical nature of cross-tenant data exposure, organizations should immediately restrict access to the Dify plugin daemon and monitor for suspicious activity. Prioritize applying the vendor-supplied patch as soon as it is released to ensure the platform's multi-tenancy security model is restored.