CVE-2025-43854

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
langgenius	dify	< 1.3.0

References

https://github.com/langgenius/dify/pull/18516Issue Tracking, Patch
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5pVendor Advisory
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5pVendor Advisory

Timeline

Published: Apr 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-438558.7tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1 CVE-2025-438567.3immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking th CVE-2025-438576.5Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5 CVE-2025-438589.2YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to CVE-2025-438599.1h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding messa CVE-2025-43866.8Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login promp CVE-2025-438607.6OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS)CVE-2025-438615.4ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored CVE-2025-438627.6Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, CVE-2025-438639.8vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Par CVE-2025-438647.5React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch t CVE-2025-438658.2React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by addin