CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Request Forgery CWE-918 in RAGFlow's agent workflow "Invoke" component, before 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Fixed in| v0.26.3 Fix commits| c4fe68e, e16d1a0 Issue refs|...

ragflow-audit

ragflow-audit RAGFlow three-vulnerability audit tool CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : Detect and exploit SSTI - RCE in the StringTransform / Message components zipslip : Offline detection of path traversal in zip entries Zip Slip apikey : Derive API key from sharing link be...

CVE-2026-49951

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

EUVD-2026-118333

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951

RAGFlow versions before 0.27.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the set_api_key() function located in api/apps/llm_app.py. Authenticated attackers can exploit this by providing an unvalidated base_url parameter to the POST /v1/llm/set_api_key endpoint. This allows at...

CVE-2026-49951 RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951 RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951 RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-49951: infiniflow ragflow: RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force…

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey in...

CVE-2026-121928

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-121927

A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...

EUVD-2026-117013

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-121928

The InfiniFlow RAGFlow application (up to version 0.27.2 ) is vulnerable to a cross-site scripting (XSS) flaw within the Images API component. The issue originates from improper processing within the api/utils/file_utils.py file, which can be exploited remotely. An exploit is publicly available a...

CVE-2026-121928 InfiniFlow RAGFlow Images API file_utils.py cross site scripting

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-121928 InfiniFlow RAGFlow Images API file_utils.py cross site scripting

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

EUVD-2026-117009

A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...

CVE-2026-121927 InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery

A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...

CVE-2026-121927

A Server-Side Request Forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow versions up to 0.27.3 . The flaw is located within the Seafile Connector component, specifically in the _account_get function of the common/data_source/seafile_connector.py file. An attacker can achieve remote executi...

CVE-2026-121585

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...