RAGFlow 安全漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow that stems from an insecure direct object reference that results in unauthorized cross-tenant access...

PT-2025-7554 · Ragflow · Ragflow

Name of the Vulnerable Software and Affected Versions: RAGFlow versions /user/list" and "POST //user". Recommendations: For RAGFlow versions /user/list" and "POST //user", to minimize the risk of exploitation...

CVE-2024-10131

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-53450

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2024-53450

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2024-53450: Out-of-bounds Read

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2024-53450

RAGFlow version 0.13.0 is affected by a vulnerability involving improper access control within the document-hooks.ts file. This flaw allows unauthorized parties to gain access to private user documents. As a temporary workaround, users are advised to review and limit user permissions to minimize ...

PT-2024-35745 · Ragflow · Ragflow

Name of the Vulnerable Software and Affected Versions: RAGFlow version 0.13.0 Description: The issue is related to improper access control in the document-hooks.ts file, which allows unauthorized access to user documents. Recommendations: For RAGFlow version 0.13.0, consider restricting access to...

CVE-2024-53450

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2024-53450

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2024-10131

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131: Improper Control of Generation of Code

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

RAGFlow 命令注入漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A command injection vulnerability exists in RAGFlow version 0.11.0, which stems from a lack of comprehensive input validation or cleanup, causing the addllm function in llmapp.py to contain a...

PT-2024-16051 · Infiniflow · Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version 0.11.0 Description: The issue concerns a remote code execution vulnerability in the add llm function, located in llm app.py. This function utilizes user-supplied input, specifically req'llm factory' and req'llm name...