CVE-2026-121928

The InfiniFlow RAGFlow application (up to version 0.27.2 ) is vulnerable to a cross-site scripting (XSS) flaw within the Images API component. The issue originates from improper processing within the api/utils/file_utils.py file, which can be exploited remotely. An exploit is publicly available a...