CVE-2025-69286

🗓️ 31 Dec 2025 21:52:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

RAGFlow before 0.22.0 had predictable token generation that allowed deriving the API key and beta token from the shared web address.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-69286	1 Jan 202601:12	–	circl
CNNVD	RAGFlow 安全漏洞	31 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-69286 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability	31 Dec 202521:52	–	cvelist
GithubExploit	Exploit for Generation of Predictable Numbers or Identifiers in Infiniflow Ragflow	11 Aug 202602:36	–	githubexploit
EUVD	EUVD-2025-206092	31 Dec 202521:52	–	euvd
Kitploit	ragflow-audit	2 Oct 202617:24	–	kitploit
NVD	CVE-2025-69286	31 Dec 202522:15	–	nvd
Positive Technologies	PT-2025-54469	31 Dec 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-69286: Generation of Predictable Numbers or Identifiers	31 Dec 202500:00	–	rapid7
RedhatCVE	CVE-2025-69286	1 Jan 202622:28	–	redhatcve

NVD

Vulners

Node

infiniflow ragflowRange<0.22.0

[
  {
    "vendor": "infiniflow",
    "product": "ragflow",
    "versions": [
      {
        "version": "< 0.22.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/infiniflow/ragflow/security/advisories/GHSA-9j5g-g4xm-57w7
github	www.github.com/infiniflow/ragflow/blob/v0.20.5/api/apps/system_app.py
github	www.github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/api_utils.py
github	www.github.com/infiniflow/ragflow/commit/a3bb4aadcc3494fb27f2a9933b4c46df8eb532e6
github	www.github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/__init__.py

Parameter	Position	Path	Description	CWE
canvas	request body	/v1/canvas/set	SSTI-based canvas creation used to trigger code execution via RAGFlow's canvas workflow.	CWE-340

23 Sep 2026 14:10Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.8

CVSS 49.3

EPSS0.00797

SSVC

CWE-340