UpHeron
All vulnerabilities

Servers and applications

CVE-2025-43854

DIFY vulnerable to Clickjacking Attack

Severity
Low 2.3
Published
28 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-jhgq-cx3f-vj5p
Sources
NVD, Project advisories (GitHub)

Description

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users.…

Affected software

SoftwareAffected versions
DifyServers and applications · cpe:a:langgenius:dify
  • Every version up to 0.6.8
DifyServers and applications · github:langgenius/dify
  • Every version up to 0.6.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-43854
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-43854
  • GitHub Advisory Database https://github.com/advisories/GHSA-jhgq-cx3f-vj5p
  • github.com https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p