CVE-2025-0184: A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section…

PriorityP338medium6.5CVSS 3.0

AVNACLPRLUINSUCHINAN

EPSS

0.47%

37.3th percentile

A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
langgenius	dify	< 0.11.0	0.11.0
langgenius	langgenius_dify	>= unspecified < 0.11.0	0.11.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.