CVE-2024-12779

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the "POST /v1/llm/addllm" and "POST /v1/conversation/tts" endpoints. Attackers can specify an arbitrary URL as the "apibase" when adding an "OPENAITTS" model, and...

PT-2025-12148

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version 0.12.0 Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to specify an arbitrary URL as the api base when adding an OPENAITTS model. This can lead to unauthorized access to internal web...

CVE-2024-12779: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/addllm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the apibase when adding an OPENAITTS model, and subsequently...