happen again? Unauthorized SSRF vulnerability in controllers.console.remote_files.RemoteFileUploadApi #15185 #22081

Closed
opened 2026-02-21 20:15:42 -05:00 by yindo · 4 comments
Owner

Originally created by @990833242 on GitHub (Feb 4, 2026).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交,否则会被关闭 :)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.11.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Our Safe Engineer find https://github.com/langgenius/dify/issues/15185 this case , happed again on dify-1.11.1. So please help check how to resolve it?

✔️ Expected Behavior

Our Safe Engineer find https://github.com/langgenius/dify/issues/15185 this case , happed again on dify-1.11.1. So please help check how to resolve it?

Actual Behavior

No response

Originally created by @990833242 on GitHub (Feb 4, 2026). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交,否则会被关闭 :) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.11.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce Our Safe Engineer find https://github.com/langgenius/dify/issues/15185 this case , happed again on dify-1.11.1. So please help check how to resolve it? ### ✔️ Expected Behavior Our Safe Engineer find https://github.com/langgenius/dify/issues/15185 this case , happed again on dify-1.11.1. So please help check how to resolve it? ### ❌ Actual Behavior _No response_
yindo added the 🐞 bug label 2026-02-21 20:15:42 -05:00
yindo closed this issue 2026-02-21 20:15:42 -05:00
Author
Owner

@dosubot[bot] commented on GitHub (Feb 4, 2026):

The SSRF vulnerability in RemoteFileUploadApi for Dify 1.11.1 happens because the API accepts a user-supplied URL and makes outbound requests without enforcing authentication or access control, allowing attackers to trigger requests to arbitrary addresses details & code example. This issue is not fixed in 1.11.1—recent SSRF mitigations (like internal IP filtering and stricter proxy validation) were added in later versions and are not present in your release.

To mitigate this in your current setup:

  1. Add authentication and authorization to the RemoteFileUploadApi endpoint. Require users to be logged in and check if they are allowed to access the requested URL before making any outbound request. You can follow the code example in issue #15185 (using a @login_required decorator and a user authorization function).

  2. Harden your SSRF proxy (Squid) configuration. Make sure your squid.conf blocks access to internal/private networks and restricts allowed ports. There is a proposed "secure by default" config that blocks private networks and only allows HTTP/HTTPS on standard ports see PR. You can customize your squid.conf to implement similar restrictions.

  3. Restart your Docker services after updating proxy configs to ensure changes take effect reference.

Upgrading to a newer Dify version with built-in SSRF protections is the most robust solution, but if you must stay on 1.11.1, these steps will help reduce your risk. Always monitor for SSRF attempts and review your proxy logs for suspicious activity.

To reply, just mention @dosu.


How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Feb 4, 2026): <!-- Answer --> The SSRF vulnerability in RemoteFileUploadApi for Dify 1.11.1 happens because the API accepts a user-supplied URL and makes outbound requests without enforcing authentication or access control, allowing attackers to trigger requests to arbitrary addresses [details & code example](https://github.com/langgenius/dify/issues/15185). This issue is not fixed in 1.11.1—recent SSRF mitigations (like internal IP filtering and stricter proxy validation) were added in later versions and are not present in your release. To mitigate this in your current setup: 1. **Add authentication and authorization** to the RemoteFileUploadApi endpoint. Require users to be logged in and check if they are allowed to access the requested URL before making any outbound request. You can follow the code example in [issue #15185](https://github.com/langgenius/dify/issues/15185) (using a `@login_required` decorator and a user authorization function). 2. **Harden your SSRF proxy (Squid) configuration**. Make sure your `squid.conf` blocks access to internal/private networks and restricts allowed ports. There is a proposed "secure by default" config that blocks private networks and only allows HTTP/HTTPS on standard ports [see PR](https://github.com/langgenius/dify/pull/24393). You can customize your `squid.conf` to implement similar restrictions. 3. **Restart your Docker services** after updating proxy configs to ensure changes take effect [reference](https://github.com/langgenius/dify/issues/17406). Upgrading to a newer Dify version with built-in SSRF protections is the most robust solution, but if you must stay on 1.11.1, these steps will help reduce your risk. Always monitor for SSRF attempts and review your proxy logs for suspicious activity. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20SSRF%20vulnerability%20in%20RemoteFileUploadApi%20for%20Dify%201.11.1%20happens%20because%20the%20API%20accepts%20a%20user-supplied%20URL%20and%20makes%20outbound%20requests%20without%20enforcing%20authentication%20or%20access%20control%2C%20allowing%20attackers%20to%20trigger%20requests%20to%20arbitrary%20addresses%C2%A0%5Bdetails%20%26%20code%20example%5D%28https%3A//github.com/langgenius/dify/issues/15185%29.%20This%20issue%20is%20not%20fixed%20in%201.11.1%E2%80%94recent%20SSRF%20mitigations%20%28like%20internal%20IP%20filtering%20and%20stricter%20proxy%20validation%29%20were%20added%20in%20later%20versions%20and%20are%20not%20present%20in%20your%20release.%0A%0ATo%20mitigate%20this%20in%20your%20current%20setup%3A%0A%0A1.%20%2A%2AAdd%20authentication%20and%20authorization%2A%2A%20to%20the%20RemoteFileUploadApi%20endpoint.%20Require%20users%20to%20be%20logged%20in%20and%20check%20if%20they%20are%20allowed%20to%20access%20the%20requested%20URL%20before%20making%20any%20outbound%20request.%20You%20can%20follow%20the%20code%20example%20in%20%5Bissue%20%2315185%5D%28https%3A//github.com/langgenius/dify/issues/15185%29%20%28using%20a%20%60%40login_required%60%20decorator%20and%20a%20user%20authorization%20function%29.%0A%0A2.%20%2A%2AHarden%20your%20SSRF%20proxy%20%28Squid%29%20configuration%2A%2A.%20Make%20sure%20your%20%60squid.conf%60%20blocks%20access%20to%20internal/private%20networks%20and%20restricts%20allowed%20ports.%20There%20is%20a%20proposed%20%22secure%20by%20default%22%20config%20that%20blocks%20private%20networks%20and%20only%20allows%20HTTP/HTTPS%20on%20standard%20ports%C2%A0%5Bsee%20PR%5D%28https%3A//github.com/langgenius/dify/pull/24393%29.%20You%20can%20customize%20your%20%60squid.conf%60%20to%20implement%20similar%20restrictions.%0A%0A3.%20%2A%2ARestart%20your%20Docker%20services%2A%2A%20after%20updating%20proxy%20configs%20to%20ensure%20changes%20take%20effect%C2%A0%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/17406%29.%0A%0AUpgrading%20to%20a%20newer%20Dify%20version%20with%20built-in%20SSRF%20protections%20is%20the%20most%20robust%20solution%2C%20but%20if%20you%20must%20stay%20on%201.11.1%2C%20these%20steps%20will%20help%20reduce%20your%20risk.%20Always%20monitor%20for%20SSRF%20attempts%20and%20review%20your%20proxy%20logs%20for%20suspicious%20activity.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31972)
Author
Owner

@990833242 commented on GitHub (Feb 4, 2026):

The SSRF vulnerability in RemoteFileUploadApi for Dify 1.11.1 happens because the API accepts a user-supplied URL and makes outbound requests without enforcing authentication or access control, allowing attackers to trigger requests to arbitrary addresses details & code example. This issue is not fixed in 1.11.1—recent SSRF mitigations (like internal IP filtering and stricter proxy validation) were added in later versions and are not present in your release.

To mitigate this in your current setup:

  1. Add authentication and authorization to the RemoteFileUploadApi endpoint. Require users to be logged in and check if they are allowed to access the requested URL before making any outbound request. You can follow the code example in issue #15185 (using a @login_required decorator and a user authorization function).
  2. Harden your SSRF proxy (Squid) configuration. Make sure your squid.conf blocks access to internal/private networks and restricts allowed ports. There is a proposed "secure by default" config that blocks private networks and only allows HTTP/HTTPS on standard ports see PR. You can customize your squid.conf to implement similar restrictions.
  3. Restart your Docker services after updating proxy configs to ensure changes take effect reference.

Upgrading to a newer Dify version with built-in SSRF protections is the most robust solution, but if you must stay on 1.11.1, these steps will help reduce your risk. Always monitor for SSRF attempts and review your proxy logs for suspicious activity.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

OK, em~ which version can resolve this issue ?

@990833242 commented on GitHub (Feb 4, 2026): > The SSRF vulnerability in RemoteFileUploadApi for Dify 1.11.1 happens because the API accepts a user-supplied URL and makes outbound requests without enforcing authentication or access control, allowing attackers to trigger requests to arbitrary addresses [details & code example](https://github.com/langgenius/dify/issues/15185). This issue is not fixed in 1.11.1—recent SSRF mitigations (like internal IP filtering and stricter proxy validation) were added in later versions and are not present in your release. > > To mitigate this in your current setup: > > 1. **Add authentication and authorization** to the RemoteFileUploadApi endpoint. Require users to be logged in and check if they are allowed to access the requested URL before making any outbound request. You can follow the code example in [issue #15185](https://github.com/langgenius/dify/issues/15185) (using a `@login_required` decorator and a user authorization function). > 2. **Harden your SSRF proxy (Squid) configuration**. Make sure your `squid.conf` blocks access to internal/private networks and restricts allowed ports. There is a proposed "secure by default" config that blocks private networks and only allows HTTP/HTTPS on standard ports [see PR](https://github.com/langgenius/dify/pull/24393). You can customize your `squid.conf` to implement similar restrictions. > 3. **Restart your Docker services** after updating proxy configs to ensure changes take effect [reference](https://github.com/langgenius/dify/issues/17406). > > Upgrading to a newer Dify version with built-in SSRF protections is the most robust solution, but if you must stay on 1.11.1, these steps will help reduce your risk. Always monitor for SSRF attempts and review your proxy logs for suspicious activity. > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6684da6a-ba98-4606-9b70-23adfc864a3d?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=The%20SSRF%20vulnerability%20in%20RemoteFileUploadApi%20for%20Dify%201.11.1%20happens%20because%20the%20API%20accepts%20a%20user-supplied%20URL%20and%20makes%20outbound%20requests%20without%20enforcing%20authentication%20or%20access%20control%2C%20allowing%20attackers%20to%20trigger%20requests%20to%20arbitrary%20addresses%C2%A0%5Bdetails%20%26%20code%20example%5D%28https%3A//github.com/langgenius/dify/issues/15185%29.%20This%20issue%20is%20not%20fixed%20in%201.11.1%E2%80%94recent%20SSRF%20mitigations%20%28like%20internal%20IP%20filtering%20and%20stricter%20proxy%20validation%29%20were%20added%20in%20later%20versions%20and%20are%20not%20present%20in%20your%20release.%0A%0ATo%20mitigate%20this%20in%20your%20current%20setup%3A%0A%0A1.%20%2A%2AAdd%20authentication%20and%20authorization%2A%2A%20to%20the%20RemoteFileUploadApi%20endpoint.%20Require%20users%20to%20be%20logged%20in%20and%20check%20if%20they%20are%20allowed%20to%20access%20the%20requested%20URL%20before%20making%20any%20outbound%20request.%20You%20can%20follow%20the%20code%20example%20in%20%5Bissue%20%2315185%5D%28https%3A//github.com/langgenius/dify/issues/15185%29%20%28using%20a%20%60%40login_required%60%20decorator%20and%20a%20user%20authorization%20function%29.%0A%0A2.%20%2A%2AHarden%20your%20SSRF%20proxy%20%28Squid%29%20configuration%2A%2A.%20Make%20sure%20your%20%60squid.conf%60%20blocks%20access%20to%20internal/private%20networks%20and%20restricts%20allowed%20ports.%20There%20is%20a%20proposed%20%22secure%20by%20default%22%20config%20that%20blocks%20private%20networks%20and%20only%20allows%20HTTP/HTTPS%20on%20standard%20ports%C2%A0%5Bsee%20PR%5D%28https%3A//github.com/langgenius/dify/pull/24393%29.%20You%20can%20customize%20your%20%60squid.conf%60%20to%20implement%20similar%20restrictions.%0A%0A3.%20%2A%2ARestart%20your%20Docker%20services%2A%2A%20after%20updating%20proxy%20configs%20to%20ensure%20changes%20take%20effect%C2%A0%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/17406%29.%0A%0AUpgrading%20to%20a%20newer%20Dify%20version%20with%20built-in%20SSRF%20protections%20is%20the%20most%20robust%20solution%2C%20but%20if%20you%20must%20stay%20on%201.11.1%2C%20these%20steps%20will%20help%20reduce%20your%20risk.%20Always%20monitor%20for%20SSRF%20attempts%20and%20review%20your%20proxy%20logs%20for%20suspicious%20activity.) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31972) OK, em~ which version can resolve this issue ?
Author
Owner

@dosubot[bot] commented on GitHub (Feb 4, 2026):

The SSRF vulnerability in RemoteFileUploadApi is resolved in Dify version 1.12.0 and later. This version includes internal IP filtering, stricter SSRF protections, and requires authentication for remote file uploads, effectively closing the vulnerability you described details PR #29548 PR #31466. Upgrading to 1.12.0 or newer will address this issue.

To reply, just mention @dosu.


How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Feb 4, 2026): <!-- Answer --> The SSRF vulnerability in RemoteFileUploadApi is resolved in Dify version 1.12.0 and later. This version includes internal IP filtering, stricter SSRF protections, and requires authentication for remote file uploads, effectively closing the vulnerability you described [details](https://github.com/langgenius/dify/issues/31632) [PR #29548](https://github.com/langgenius/dify/pull/29548) [PR #31466](https://github.com/langgenius/dify/pull/31466). Upgrading to 1.12.0 or newer will address this issue. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f07ac99b-ded8-41b3-b822-0e40c1330df3?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20SSRF%20vulnerability%20in%20RemoteFileUploadApi%20is%20resolved%20in%20Dify%20version%201.12.0%20and%20later.%20This%20version%20includes%20internal%20IP%20filtering%2C%20stricter%20SSRF%20protections%2C%20and%20requires%20authentication%20for%20remote%20file%20uploads%2C%20effectively%20closing%20the%20vulnerability%20you%20described%C2%A0%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/31632%29%C2%A0%5BPR%20%2329548%5D%28https%3A//github.com/langgenius/dify/pull/29548%29%C2%A0%5BPR%20%2331466%5D%28https%3A//github.com/langgenius/dify/pull/31466%29.%20Upgrading%20to%201.12.0%20or%20newer%20will%20address%20this%20issue.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31972)
Author
Owner

@crazywoola commented on GitHub (Feb 5, 2026):

First, if you believe this is a security-related issue, please submit it through a GitHub Advisory.

This issue appears to be duplicated and outdated. Based on our assessment, the interface in question does not exhibit any dangerous behavior. We already apply SSRF proxy filtering internally; for more details on how this works, you may refer to the Squid documentation.

If you still consider this to be a noteworthy concern, please provide a complete proof of concept (PoC) via GitHub Advisory. A single-sentence description is insufficient for us to properly investigate and verify the issue.

@crazywoola commented on GitHub (Feb 5, 2026): First, if you believe this is a security-related issue, please submit it through a GitHub Advisory. This issue appears to be duplicated and outdated. Based on our assessment, the interface in question does not exhibit any dangerous behavior. We already apply SSRF proxy filtering internally; for more details on how this works, you may refer to the Squid documentation. If you still consider this to be a noteworthy concern, please provide a complete proof of concept (PoC) via GitHub Advisory. A single-sentence description is insufficient for us to properly investigate and verify the issue.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#22081