ragflow-audit

ragflow-audit RAGFlow 3件の脆弱性監査ツール（CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286） ssti ：StringTransform / Message コンポーネントの SSTI を検出・悪用して RCE へ zipslip ：zip エントリのパストラバーサル（Zip Slip）をオフラインで検出 apikey ：共有リンクの beta から API キーを推定（uuid1 タイムスタンプ列挙） 純 Python 標準ライブラリのみ、サードパーティ依存なし。Python 3.8+ でそのまま実行可能。 使い...

EUVD-2026-91113

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

EUVD-2026-91116

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

EUVD-2026-91118

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

EUVD-2026-91114

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91117

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

EUVD-2026-91115

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51897

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51892

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-75898

CVE-2026-75898 — RAGFlow InvokeコンポーネントのSSRF RAGFlowのエージェントワークフロー「Invoke」コンポーネントにおけるサーバーサイドリクエストフォージェリ（CWE-918）、0.26.3より前のバージョン が影響を受けます。 | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N 修正バージョン| v0.26.3 修正コミット| c4fe68e, e16d1a0 関連Issue| infiniflow/ragflow15425,...

CVE-2026-51896

The infiniflow ragflow version 0.25.3 is vulnerable to improper access control within the resume functionality located at api/apps/connector_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations , depending on the exposed entry point. No speci...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

PT-2026-104048

Name of the Vulnerable Software and Affected Versions Ragflow versions prior to 0.24.1 Description Improper access control exists in the update metadata setting function located in the api/apps/kb app.py file. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossin...

CVE-2026-51893

The software infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via the trace_mindmap function. The root cause is an externally reachable path that accepts a caller-selected object or tenant identifier, leading to a data-access operation that lacks a visible owner, tenant, worksp...

CVE-2026-51892

The infiniflow ragflow version 0.24.0 is vulnerable to an Incorrect Access Control flaw. The vulnerability exists in the /v1/document/get/ endpoint, which may allow unauthorized access to documents. No specific root cause, remediation, or exploitation details are provided in the documents.

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...