Issue Station
Sign In
Tools hereToolbox

dify - 💡(How to fix) Fix File upload extension blacklist is empty by default — allows executable upload

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The file upload extension blacklist is empty by default, allowing all file types to be uploaded. The .env.example even documents the recommended security setting but makes it opt-in.

Root Cause

The file upload extension blacklist is empty by default, allowing all file types to be uploaded. The .env.example even documents the recommended security setting but makes it opt-in.

Code Example

UPLOAD_FILE_EXTENSION_BLACKLIST=
# Empty by default to allow all file types.
# Recommended: exe,bat,cmd,com,scr,vbs,ps1,msi,dll
RAW_BUFFERClick to expand / collapse

CWE-78: File Extension Blacklist Empty by Default — Arbitrary File Upload

Severity: MEDIUM (CVSS 5.3)

Location

api/.env.example:

UPLOAD_FILE_EXTENSION_BLACKLIST=
# Empty by default to allow all file types.
# Recommended: exe,bat,cmd,com,scr,vbs,ps1,msi,dll

Description

The file upload extension blacklist is empty by default, allowing all file types to be uploaded. The .env.example even documents the recommended security setting but makes it opt-in.

Impact

Users can upload:

  • Executables (.exe, .bat, .sh, .ps1)
  • DLLs (.dll, .so)
  • Scripts (.py, .js)
  • Archives containing malicious payloads

These files are stored in the storage/ directory which may be served or accessed by other components of the platform.

Remediation

Enable the recommended blacklist by default: exe,bat,cmd,com,scr,vbs,ps1,msi,dll,sh,py,js

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING