Ragflow
CVE-2026-24770
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload malicious ZIP archive
-
ExploitMinerUParser extracts without filename sanitization
-
ExecutionZip Slip writes to arbitrary server paths
-
ImpactExecute arbitrary code via file overwrite
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | RAGFlow version 0.23.1 or earlier with MinerU parser enabled; attacker must control or intercept mineru_server_url ZIP file source; no authentication required for RAGFlow instance accepting ZIP uploads from external MinerU server. |
| Impact | CVSS 9.8, EPSS 0.9%. PoC available. RAG engines typically have access to sensitive document stores and API keys for LLM services. |
| Exploit ScenarioDerived | Attacker crafts traversal request to read /etc/passwd, application configuration files containing database credentials, or LLM API keys stored on the server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary files from the server filesystem. PoC available, patch available.
Earlier versions of this analysis (1)
Unauthenticated path traversal in RAGFlow RAG engine.
RemediationAI
Update RAGFlow to a patched version. Restrict filesystem permissions for the RAGFlow process. Rotate any API keys that may have been exposed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 in RAGFlow 0.23.1. Insufficient path sanitization allows directory traversal sequences to escape the intended file access scope, enabling arbitrary file reads from the server.
Know when Ragflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in _extract_zip_no_root fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.
Executive ViewAI
A critical vulnerability (CVSS 9.8) in RAGFlow poses an immediate threat to organizations using this open-source RAG engine, with a 90% likelihood of active exploitation. Any system running vulnerable versions is at high risk of unauthorized access, data exfiltration, and operational compromise, requiring urgent patching to prevent potential data breach or service disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerabilit
RAGFlow versions prior to 0.22.0 generate API keys and beta assistant/agent share tokens with a predictable scheme, lett
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulne
Remote code execution in RAGFlow versions prior to 0.23.0 allows a low-privileged authenticated user (a normal login acc
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high s
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVS
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data query
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operatin
Unauthenticated network attackers can reach the get_dataset entry point in RAGFlow 0.24.0's evaluation_app API and, depe
Exploit-DB