CVE-2025-56520

MEDIUM 5.3CVE-2025-56520 · Published 30/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
dify dify	`= 1.6.0`	No fix yet

Description

Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. A different vulnerability than CVE-2025-29720.

References

langgenius/dify · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free