RAGFlow CVE-2026-51897

Exploitation requires network reachability to a RAGFlow 0.24.0 instance exposing the evaluation_app's get_dataset entry point; because the vulnerability is a missing access-control/authorization check, no valid credentials are needed (CVSS PR:N). The key limiting factor is that the code/command-execution outcome is conditioned on 'the exposed entry' - i.e., the specific reachable endpoint or deployment path that leads to execution must be present, so instances that do not expose the evaluation_app interface to the attacker, or that place RAGFlow behind authentication/network segmentation (its common internal deployment model), are not exploitable. Version is specifically RAGFlow 0.24.0.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) paints a worst-case picture: network-reachable, no authentication, no user interaction, and full compromise via attacker-controlled code or command execution - consistent with the CWE-284 improper access control root cause, where the missing authorization check effectively yields PR:N. However, the real-world signals temper this: EPSS is only 0.32% (22nd percentile), indicating low modeled probability of exploitation in the near term, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. A public artifact - a GitHub gist from researcher 'Ro1ME' - is referenced, so publicly available exploit code exists, which lowers the barrier to opportunistic attacks even while widespread exploitation is not yet observed. The conflict to flag: the description's phrase 'Depending on the exposed entry' implies the code-execution outcome is conditional on which endpoint/configuration is reachable, which is NOT reflected in the AC:L rating - the practical attack complexity may be higher than the vector suggests, so verify the exact trigger path against the gist/vendor. Net assessment: a genuinely severe flaw by impact, but current urgency is moderated by low EPSS, absence from KEV, and RAGFlow's typically internal/non-internet-facing deployment; POC availability is the main factor raising priority above a theoretical high-CVSS issue.

An attacker who can reach a RAGFlow 0.24.0 instance's evaluation_app interface sends a crafted request to the get_dataset functionality, abusing the missing access-control check to reach an entry point that executes attacker-supplied code or system commands on the host. Because the flaw requires no authentication or user interaction over the network, an exposed instance can be compromised directly; a public gist POC exists, reducing the effort needed to reproduce the attack.