Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42138 Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file… https://www.cve.org/CVERecord?id=CVE-2026-42138
Post summary
The entry announces CVE‑2026‑42138, noting that unauthenticated users can upload SVG files to Dify before v1.13.1, with a link to the CVE record but no PoC, exploit code, or mitigation details.
CVE-2026-42138 Unauthenticated Cross-Site Scripting via SVG File Upload in Dify ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42138 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post reports a new unauthenticated XSS vulnerability (CVE-2026-42138) in Dify that arises from uploading SVG files, linking to a detailed vulnerability page but providing no PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langgenius | dify | - | node.js | - |