CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Request Forgery CWE-918 in RAGFlow's agent workflow "Invoke" component, before 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Fixed in| v0.26.3 Fix commits| c4fe68e, e16d1a0 Issue refs|...

ragflow-audit

ragflow-audit RAGFlow three-vulnerability audit tool CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : Detect and exploit SSTI - RCE in the StringTransform / Message components zipslip : Offline detection of path traversal in zip entries Zip Slip apikey : Derive API key from sharing link be...

EUVD-2026-91115

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91116

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

EUVD-2026-91118

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

EUVD-2026-91114

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91113

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

EUVD-2026-91117

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51897

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51892

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51896

The software infiniflow ragflow version 0.25.3 is affected by a vulnerability involving improper access control in the resume function located within the api/apps/connector_app.py endpoint. This security flaw enables an attacker to perform unauthorized cross-session or privilege-crossing operatio...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

CVE-2026-51897: Improper Access Control

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51893: Improper Access Control

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51896: Improper Access Control

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51895: Improper Access Control

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...