CVE-2026-42138 Dify Vulnerable to Stored XSS via SVG-file upload

What is CVE-2026-42138?

CVE-2026-42138 is a medium-severity vulnerability in langgenius dify, published on 4 May 2026.

Official description

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.

Weakness: CWE-79

Which versions are affected by CVE-2026-42138?

It affects 1 product.

Products include Langgenius Dify.

How do I fix CVE-2026-42138?

No fix has been published for CVE-2026-42138 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-42138 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42138 exists.

Other vulnerabilities in langgenius dify

• CVE-2025-56157 Hardcoded credentials in n/a Critical 9.8
• CVE-2025-3466 Unsanitized Input in langgenius/dify Critical 9.8
• CVE-2025-63386 Misconfiguration in n/a Critical 9.1
• CVE-2025-63388 Misconfiguration in n/a Critical 9.1
• CVE-2024-10252 Code Injection in langgenius/dify High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cg94-8v83-7hjj.