CVE-2026-41948

Critical Dify Cross-Tenant Path Traversal Flaw Enables Unauthorized Access to Internal Plugin APIs CVE-2026-41948

A critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.