Ragflow

10 CVEs product

Monthly

CVE-2026-24770 CRITICAL POC PATCH Act Now

Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary files from the server filesystem. PoC available, patch available.

RCE AI / ML Ragflow
NVD GitHub
CVSS 3.1
9.8
EPSS
0.9%
CVE-2025-48187 CRITICAL POC PATCH Act Now

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE Ragflow
NVD GitHub
CVSS 3.1
9.1
EPSS
0.3%
CVE-2024-12880 MEDIUM POC This Month

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD
CVSS 3.1
6.5
EPSS
0.1%
CVE-2024-12871 MEDIUM POC This Month

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

XSS Ragflow
NVD
CVSS 3.1
5.4
EPSS
0.1%
CVE-2024-12869 MEDIUM POC Monitor

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD
CVSS 3.1
4.3
EPSS
0.1%
CVE-2024-12779 HIGH POC This Week

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SSRF Authentication Bypass Ragflow
NVD
CVSS 3.1
7.5
EPSS
0.1%
CVE-2024-12450 CRITICAL POC PATCH Act Now

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Google SSRF RCE Ragflow Chrome
NVD GitHub
CVSS 3.1
9.8
EPSS
0.3%
CVE-2024-12433 CRITICAL POC PATCH Act Now

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE Deserialization Ragflow
NVD GitHub
CVSS 3.0
9.8
EPSS
2.1%
CVE-2025-27135 HIGH POC This Week

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQLi Ragflow
NVD GitHub
CVSS 4.0
8.9
EPSS
0.3%
CVE-2025-25282 HIGH POC This Week

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD GitHub
CVSS 3.0
8.1
EPSS
0.1%
CVE-2026-24770
EPSS 1% CVSS 9.8
CRITICAL POC PATCH Act Now

Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary files from the server filesystem. PoC available, patch available.

RCE AI / ML Ragflow
NVD GitHub
CVE-2025-48187
EPSS 0% CVSS 9.1
CRITICAL POC PATCH Act Now

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE Ragflow
NVD GitHub
CVE-2024-12880
EPSS 0% CVSS 6.5
MEDIUM POC This Month

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD
CVE-2024-12871
EPSS 0% CVSS 5.4
MEDIUM POC This Month

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

XSS Ragflow
NVD
CVE-2024-12869
EPSS 0% CVSS 4.3
MEDIUM POC Monitor

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD
CVE-2024-12779
EPSS 0% CVSS 7.5
HIGH POC This Week

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SSRF Authentication Bypass Ragflow
NVD
CVE-2024-12450
EPSS 0% CVSS 9.8
CRITICAL POC PATCH Act Now

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Google SSRF RCE +2
NVD GitHub
CVE-2024-12433
EPSS 2% CVSS 9.8
CRITICAL POC PATCH Act Now

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE Deserialization Ragflow
NVD GitHub
CVE-2025-27135
EPSS 0% CVSS 8.9
HIGH POC This Week

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQLi Ragflow
NVD GitHub
CVE-2025-25282
EPSS 0% CVSS 8.1
HIGH POC This Week

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Ragflow
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy