CVE-2025-3595: Dify Cross-User File Read Vulnerability Analysis and POC

Vulnerability Summary: LangGenius/Dify Cross-User File Read Vulnerability Vulnerability Overview Vulnerability Type: Cross-User File Read Severity: High CVE ID: CVE-2025-3595 Affected Component: LangGenius/Dify Report Date: December 17, 2025 Discoverer: IdoZafran Impact Scope Allows users to bypass permission checks, workspace isolation, and signed URL protections by using only UUIDs. Enables access to any uploaded file within the same tenant. All files within a tenant can be viewed by authenticated users, bypassing permission checks and defense mechanisms. Allows cross-workspace access. Vulnerability Details When a user sends a file to a Dify chat/workflow: 1. The user uploads the file via the endpoint. 2. The server uses the storage layer to write file metadata to the table. 3. The UUID is appended to the array of the message. 4. The message and its files are saved to the table. When a user revisits a conversation, Dify displays previews of attached files: The client queries the messages of the current conversation and creates preview links. The links include a generation timestamp (default expiration: 5 minutes). A nonce (used only once) is employed. The link is signed and the signature is appended. Key Issue: The server successfully processes UUIDs of any attached files in the array from the same tenant, even if the sender does not have permission to access that file. Remediation Ensure the existence of file reading workflows. Ensure proper verification of file access permissions when sending files. Strengthen UUID validation mechanisms to ensure that only users with access rights to a file can use its UUID. POC Code DSL Workflow Configuration Exploitation Code Note: Testing indicates that the document type does not need to be known for the exploit to work; we were able to extract documents by specifying .

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-3595: Dify Cross-User File Read Vulnerability Analysis and POC