CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

Low 2.3 Published 28 Apr 2025 Updated 28 Apr 2025

Attackers can trick users into performing unauthorized actions via clickjacking in the default DIFY setup, compromising user security and privacy.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-43854?

CVE-2025-43854 is a low-severity vulnerability in langgenius dify, published on 28 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

Weakness: CWE-1021

Which versions are affected by CVE-2025-43854?

It affects 1 product.

Products include Langgenius Dify.

How do I fix CVE-2025-43854?

No fix has been published for CVE-2025-43854 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-43854 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-43854 exists.

Sources

Also known as GHSA-jhgq-cx3f-vj5p.