CVE-2025-27135

RAGFlow (open-source Retrieval-Augmented Generation engine) is affected by CVE-2025-27135. Versions 0.15.1 and earlier are vulnerable due to the ExeSQL component, which extracts SQL statements from input and sends them directly to the database query, enabling SQL injection. Reported impact is hig...

CVE-2025-25282

CVE-2025-25282 pertains to RAGFlow, an open-source RAG engine. An authenticated user can exploit an Insecure Direct Object Reference (IDOR) vulnerability that enables unauthorized cross-tenant access, including listing tenant user accounts and adding users to other tenants. Affected behavior cent...

CVE-2024-12880

The CVE-2024-12880 entry concerns infiniflow/ragflow (RAGFlow-0.13.0) with a vulnerability in tenant ID handling that enables partial account takeover. If a user has access to multiple tenants, they can manipulate tenant access to query and obtain other tenants’ API tokens via endpoints: /v1/syst...

CVE-2024-12779

A Server-Side Request Forgery (SSRF) vulnerability affects infiniflow/ragflow version 0.12.0, in POST /v1/llm/add_llm and POST /v1/conversation/tts. An attacker can supply an arbitrary URL as api_base when adding an OPENAITTS model, then access the tts endpoint to read contents from that URL, pot...

CVE-2024-53450

RAGFlow 0.13.0 is affected by improper access control in document-hooks.ts, enabling unauthorized access to user documents. The issue is documented across multiple feeds (Red Hat, NVD, OSV, CNNVD, etc.) with no explicit attacker/vector details provided in the core CVE entry, but the root cause is...

CVE-2024-10131

CVE-2024-10131 affects infiniflow/ragflow 0.11.0. The add_llm function dynamically instantiates classes from model dictionaries using user-controlled req['llm_factory'] and req['llm_name'], enabling remote code execution due to insufficient input validation. Connected sources corroborate RCE risk...

CVE-2024-12871

CVE-2024-12871 describes a stored XSS in infiniflow/ragflow (0.12.0) where uploading a malicious PDF to the knowledge base leads to payload execution when viewed in Ragflow. The impact stated across sources includes session hijacking, data exfiltration, and unauthorized actions performed in the u...

CVE-2025-48187

CVE-2025-48187 affects RAGFlow up to version 0.18.1. The root cause is brute-force attacks on six-digit email verification codes without rate limiting, enabling account takeover via arbitrary registration, login, or password reset. Multiple connected sources confirm the issue and its impact. Prac...

CVE-2024-12433

CVE-2024-12433 affects infiniflow/ragflow v0.12.0. The RPC server uses a hard-coded AuthKey (authkey=b'infiniflow-token4kevinhu') and deserializes incoming data with pickle.loads() on connection.recv(), enabling remote code execution. Fixed in v0.14.0. A PoC/proof-of-concept is available in publi...

CVE-2024-12869

CVE-2024-12869 affects infiniflow/ragflow v0.12.0 and is caused by improper authentication that lets a user view another user’s invite list, exposing personal data (emails/usernames) and enabling privacy leakage. This aligns with reported impact (data leakage leading to phishing/spam risk). Some ...

CVE-2024-12450

CVE-2024-12450 affects infiniflow/ragflow 0.12.0, where web_crawl in document_app.py does not filter URL parameters, enabling Full Read SSRF to access internal addresses via the generated PDFs, and allows Arbitrary File Read through the file:// protocol. The underlying Chromium headless is used w...

CVE-2025-69286

RAGFlow prior to 0.22.0 uses an insecure key generation algorithm for API keys and beta tokens. Both tokens are generated with the same URLSafeTimedSerializer and predictable inputs, so a user with the shared assistant/agent URL can derive the personal API key, granting full control over the owne...

CVE-2026-28797

RAGFlow (open-source Retrieval-Augmented Generation engine) is affected in versions ≤0.24.0 by a Server-Side Template Injection (SSTI) in the Agent workflow Text Processing (StringTransform) and Message components. The vulnerability arises from rendering user-supplied templates with Python’s jinj...

CVE-2026-24770

RAGFlow (open‑source RAG engine) has a Zip Slip flaw in the MinerUParser that affects v0.23.1 and possibly earlier. The vulnerability arises in the ZIP extraction path (MinerUParser, _extract_zip_no_root) where filenames inside archives aren’t sanitized, enabling overwriting of arbitrary server f...

CVE-2025-51462

CVE-2025-51462 describes a stored XSS in RAGFlow 0.17.2, via api.apps.dialog_app.set_dialog: crafted input to the assistant greeting field is stored unsanitised and rendered by a markdown component with rehype-raw, enabling execution of arbitrary JavaScript. The vulnerability affects RAGFlow 0.17...

CVE-2025-68700

RAGFlow (pre-0.23.0) is affected by a Remote Code Execution vulnerability. An authenticated, low-privilege user can cause arbitrary commands on the server host via the frontend Canvas CodeExec component because untrusted stdout is parsed with eval() without filtering or sandboxing. This design fl...