Ragflow EUVD-2026-18876

Requires authenticated user access to RAGFlow 0.24.0 or prior. Attacker must have login credentials to exploit SSTI vulnerability in Agent workflow StringTransform or Message components. Remote network access required; no victim interaction needed.

This vulnerability presents high real-world risk for organizations running RAGFlow in multi-user or internet-exposed environments. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity requiring only low-privilege authentication, resulting in complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). EPSS data not provided, but the combination of remote attack vector, low complexity, and RCE capability typically correlates with elevated exploitation probability once details are public. No CISA KEV listing indicates no confirmed active exploitation in federal enterprise networks. The authentication requirement (PR:L) provides minimal barrier since RAGFlow is designed for multi-user access, and any legitimate account holder becomes a potential threat vector. The absence of vendor patch at publication time significantly elevates risk, forcing organizations to choose between continued exposure or disabling affected functionality. This represents a critical priority for any deployment with untrusted authenticated users, though risk is somewhat mitigated in single-user or fully trusted environments. The vulnerability is likely automatable once credentials are obtained, making it suitable for post-compromise lateral movement scenarios.

An authenticated attacker with a low-privilege account on a RAGFlow instance creates a new Agent workflow and adds a Text Processing or Message component. Within the component's template field, the attacker injects a malicious Jinja2 template such as {{config.__class__.__init__.__globals__['os'].popen('whoami').read()}} or similar Python object traversal payload. When the workflow executes, the unsandboxed Jinja2 renderer processes the template, executing the embedded OS command and returning output to the attacker. The attacker can escalate to persistent backdoors, data exfiltration, or pivot to other network resources using the compromised RAGFlow server's privileges. No public exploit identified at time of analysis, but the technical details in the advisory provide sufficient information for skilled attackers to develop working exploits.