What is CVE-2026-42138?
Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.
Timeline
- 2026-05-04Published to the U.S. National Vulnerability Database (NVD)
- 2026-06-17NVD record last updated
Affected product
Langgenius Dify
Remediation Steps
- Update ROS# to version 2.2.2 or later to remediate path traversal in file_server service
- Restrict network access to ROS# services using firewall rules limiting to trusted subnets
- Audit system logs for suspicious file access patterns via the file_server component
- Implement file integrity monitoring on critical ROS# configuration and binary paths
- Test all robotic process automation workflows post-update for functional regression
References
- https://github.com/langgenius/dify/security/advisories/GHSA-cg94-8v83-7hjj
- https://github.com/langgenius/dify/releases/tag/1.13.1
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-134-08.json
- https://www.siemens.com/security-advisories
- https://nvd.nist.gov/vuln/detail/CVE-2026-42138
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 3 of May 2026 (May 18 – 24)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.