Ragflow Security Vulnerabilities and Issues — Ragflow CVE List

Lucene search

InfiniflowRagflow

4 matches found

CVE•added 2025/02/25 7:15 p.m.•69 views

CVE-2025-27135

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.

9.8CVSS7.4AI score0.00048EPSS

CVE•added 2025/03/20 10:15 a.m.•40 views

CVE-2024-12450

In infiniflow/ragflow versions 0.12.0, the web_crawl function in document_app.py contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF f...

9.8CVSS7.6AI score0.00167EPSS

CVE•added 2025/03/20 10:15 a.m.•35 views

CVE-2024-12433

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server ...

9.8CVSS9.5AI score0.00861EPSS

CVE•added 2025/05/17 1:15 p.m.•32 views

CVE-2025-48187

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

9.8CVSS9.3AI score0.00059EPSS