Dify SSRF via RemoteFileUploadApi (CVE-2025-56520)
Date: 2025-09
Affected: Dify SSRF via RemoteFileUploadApi (CVE-2025-56520)
Attack vector: rce
Category: real-world
Severity: Medium
CVE: CVE-2025-56520
CWE: CWE-918
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

SSRF in Dify <= 1.6.0 via /console/api/remote-files/ endpoint. Attackers force the Dify server to make arbitrary requests to internal networks, cloud metadata services (IMDS), and localhost. Enables credential theft from cloud environments and firewall bypass. Actively exploited in the wild per CrowdSec.


Mitigations:

Architectural layers (MAESTRO):