Ragflow
Monthly
Unauthenticated network attackers can reach the get_dataset entry point in RAGFlow 0.24.0's evaluation_app API and, depending on which entry is exposed, trigger attacker-controlled code or command execution as a result of a missing authorization check (CWE-284). The flaw scores CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a worst-case path where no credentials and no user interaction are required, though exploitability is conditional on the evaluation_app interface being reachable by the attacker and on the specific exposed entry that enables execution. There is no public exploit identified at time of analysis and the EPSS score is low (0.32%, 22nd percentile); CISA KEV status is not indicated.
Incorrect access control in infiniflow RAGFlow 0.24.0 lets remote attackers reach the trace_mindmap path, supply a caller-chosen object or tenant identifier, and have that identifier flow into a data-access operation that enforces no owner, tenant, workspace, or membership binding - effectively an IDOR that exposes another tenant's RAG data. The vendor-agnostic description and the NVD-listed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) conflict with our independent assessment, which carries the same network reachability and low complexity but scores it PR:L with confidentiality-only impact (C:H/I:N/A:N), and that discrepancy should be resolved before treating the flaw as unauthenticated pre-auth data compromise. CISA KEV does not list this CVE and EPSS is only 0.14% (3rd percentile), so confirmed active exploitation is absent; no public exploit code is identified at time of analysis, although the referenced GitHub gist is publicly accessible technical material that should be reviewed as a likely proof-of-concept.
Server-side request forgery in RAGFlow before v0.26.3 allows authenticated users who can create or trigger agent workflows to direct the server to make HTTP requests to arbitrary internal destinations, including RFC 1918 addresses, loopback interfaces, link-local ranges, and cloud instance metadata endpoints. The vulnerable 'Invoke' component in agent/component/invoke.py bypasses the shared assert_url_is_safe validator consistently applied in other fetch paths (crawler, SearXNG, file-upload, RSS), and returns the fetched response body directly to the caller. No public exploit has been identified at time of analysis, though two patch commits are publicly visible on GitHub and the vulnerable code location is documented in the references.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in RAGFlow 0.24.0 and earlier allows authenticated users to execute arbitrary OS commands via unsandboxed Jinja2 template rendering in Agent workflow components. The vulnerability affects the Text Processing (StringTransform) and Message components, where user-supplied templates are processed without sandboxing. With a CVSS 8.7 score and low attack complexity (AC:L), authenticated attackers can achieve full system compromise remotely. No public exploit identified at time of analysis, and no vendor-released patch available as of publication date.
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary files from the server filesystem. PoC available, patch available.
Improper access control in InfiniFlow RAGFlow 0.24.0 lets any authenticated user read documents they do not own by calling the /v1/document/get/<doc_id> REST endpoint, because the handler fails to verify that the requested document belongs to the caller. Exploitation requires a valid account on the target instance (CVSS PR:L - this is not an unauthenticated flaw) and network reachability to the API, so real-world impact concentrates on multi-tenant or shared deployments where documents belonging to other users are stored; single-user or isolated installs expose little. No public exploit identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the issue is not listed in CISA KEV.
Incorrect access control in infiniflow RAGFlow 0.24.0 allows a caller reaching the run_mindmap code path to supply an object or tenant identifier they do not own and have the resulting data-access operation proceed, because that operation is not bound to any owner, tenant, workspace, or membership check. The result is cross-tenant information disclosure and limited data manipulation in multi-tenant or shared RAGFlow deployments where isolation between tenants is expected; NVD rates it 6.5 with an unauthenticated vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), while our assessment treats it as requiring at least a valid session/tenant context (PR:L), which materially lowers exposure for single-tenant or network-isolated instances. EPSS is 0.14% (3rd percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate-priority access-control defect rather than an emergency.
Authenticated low-privilege users can alter metadata settings of knowledge bases they do not own in RAGFlow 0.24.0 and earlier due to missing authorization in the update_metadata_setting function (api/apps/kb_app.py). This remote integrity-only flaw requires network access and valid credentials (CVSS 6.5), with no confidentiality or availability impact, and publicly available exploit code exists per SSVC (Exploitation: poc) though it is not automatable. EPSS is 0.14% (3rd percentile), and no active exploitation (CISA KEV) is reported.
Path traversal in RAGFlow through 0.27.2 allows an authenticated attacker holding a valid access token to read files that are readable by the RAGFlow service by supplying absolute file paths to the dev_insert_chunks_from_file and dev_insert_metadata_from_file tenant/dev import endpoints. The impact is bounded rather than a clean arbitrary-file-read: disclosure only succeeds for files whose contents parse into the JSON structure the importer expects and are subsequently written into a dataset, so non-conforming or binary files cannot be exfiltrated reliably and the practical exposure is limited to JSON-formatted material. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published an upstream fix (PR #19591 / commit aa78e8d) that removes the affected dev commands entirely.
Stored XSS in RAGFlow before 0.26.3 enables cross-user JavaScript execution through unsanitized agent pipeline node names rendered in a confirmation modal. An authenticated workspace member injects a payload into a DSL node name via the agent update endpoint; when a different workspace member opens the dataflow result and clicks 'Rerun from current step,' the payload executes in their browser, enabling session token theft and account takeover across the workspace trust boundary. No CISA KEV listing exists, but a public proof-of-concept is available and a vendor patch has been released as v0.26.3.
RAGFlow versions prior to 0.22.0 generate API keys and beta assistant/agent share tokens with a predictable scheme, letting anyone who holds a shared assistant or agent URL derive the owner's personal API key and take full control of their account. Exploitation is network-reachable and requires no authentication or user interaction (CVSS 4.0 8.9; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the only practical prerequisite being a valid share link from an instance that exposes shared assistants. Publicly available exploit code exists (the GitHub security advisory GHSA-9j5g-g4xm-57w7 is referenced as an exploit source) and a vendor fix is available in 0.22.0, but there is no confirmation of active exploitation (not in CISA KEV) at time of analysis.
Remote code execution in RAGFlow versions prior to 0.23.0 allows a low-privileged authenticated user (a normal login account) to run arbitrary system commands on the server host by abusing the frontend Canvas CodeExec component. The backend reads stdout returned by the code sandbox and passes it to Python's eval(), so attacker-controlled output is executed outside the intended sandbox isolation; no additional user interaction is required beyond the attacker's own session, and additional endpoints with missing access control or inverted permission logic widen the attack surface for chained exploitation. Publicly available exploit code exists and a vendor patch is available in 0.23.0, which replaces eval() with json.loads/ast.literal_eval; this is a genuine high-priority issue per our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated network attackers can reach the get_dataset entry point in RAGFlow 0.24.0's evaluation_app API and, depending on which entry is exposed, trigger attacker-controlled code or command execution as a result of a missing authorization check (CWE-284). The flaw scores CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a worst-case path where no credentials and no user interaction are required, though exploitability is conditional on the evaluation_app interface being reachable by the attacker and on the specific exposed entry that enables execution. There is no public exploit identified at time of analysis and the EPSS score is low (0.32%, 22nd percentile); CISA KEV status is not indicated.
Incorrect access control in infiniflow RAGFlow 0.24.0 lets remote attackers reach the trace_mindmap path, supply a caller-chosen object or tenant identifier, and have that identifier flow into a data-access operation that enforces no owner, tenant, workspace, or membership binding - effectively an IDOR that exposes another tenant's RAG data. The vendor-agnostic description and the NVD-listed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) conflict with our independent assessment, which carries the same network reachability and low complexity but scores it PR:L with confidentiality-only impact (C:H/I:N/A:N), and that discrepancy should be resolved before treating the flaw as unauthenticated pre-auth data compromise. CISA KEV does not list this CVE and EPSS is only 0.14% (3rd percentile), so confirmed active exploitation is absent; no public exploit code is identified at time of analysis, although the referenced GitHub gist is publicly accessible technical material that should be reviewed as a likely proof-of-concept.
Server-side request forgery in RAGFlow before v0.26.3 allows authenticated users who can create or trigger agent workflows to direct the server to make HTTP requests to arbitrary internal destinations, including RFC 1918 addresses, loopback interfaces, link-local ranges, and cloud instance metadata endpoints. The vulnerable 'Invoke' component in agent/component/invoke.py bypasses the shared assert_url_is_safe validator consistently applied in other fetch paths (crawler, SearXNG, file-upload, RSS), and returns the fetched response body directly to the caller. No public exploit has been identified at time of analysis, though two patch commits are publicly visible on GitHub and the vulnerable code location is documented in the references.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in RAGFlow 0.24.0 and earlier allows authenticated users to execute arbitrary OS commands via unsandboxed Jinja2 template rendering in Agent workflow components. The vulnerability affects the Text Processing (StringTransform) and Message components, where user-supplied templates are processed without sandboxing. With a CVSS 8.7 score and low attack complexity (AC:L), authenticated attackers can achieve full system compromise remotely. No public exploit identified at time of analysis, and no vendor-released patch available as of publication date.
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary files from the server filesystem. PoC available, patch available.
Improper access control in InfiniFlow RAGFlow 0.24.0 lets any authenticated user read documents they do not own by calling the /v1/document/get/<doc_id> REST endpoint, because the handler fails to verify that the requested document belongs to the caller. Exploitation requires a valid account on the target instance (CVSS PR:L - this is not an unauthenticated flaw) and network reachability to the API, so real-world impact concentrates on multi-tenant or shared deployments where documents belonging to other users are stored; single-user or isolated installs expose little. No public exploit identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the issue is not listed in CISA KEV.
Incorrect access control in infiniflow RAGFlow 0.24.0 allows a caller reaching the run_mindmap code path to supply an object or tenant identifier they do not own and have the resulting data-access operation proceed, because that operation is not bound to any owner, tenant, workspace, or membership check. The result is cross-tenant information disclosure and limited data manipulation in multi-tenant or shared RAGFlow deployments where isolation between tenants is expected; NVD rates it 6.5 with an unauthenticated vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), while our assessment treats it as requiring at least a valid session/tenant context (PR:L), which materially lowers exposure for single-tenant or network-isolated instances. EPSS is 0.14% (3rd percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate-priority access-control defect rather than an emergency.
Authenticated low-privilege users can alter metadata settings of knowledge bases they do not own in RAGFlow 0.24.0 and earlier due to missing authorization in the update_metadata_setting function (api/apps/kb_app.py). This remote integrity-only flaw requires network access and valid credentials (CVSS 6.5), with no confidentiality or availability impact, and publicly available exploit code exists per SSVC (Exploitation: poc) though it is not automatable. EPSS is 0.14% (3rd percentile), and no active exploitation (CISA KEV) is reported.
Path traversal in RAGFlow through 0.27.2 allows an authenticated attacker holding a valid access token to read files that are readable by the RAGFlow service by supplying absolute file paths to the dev_insert_chunks_from_file and dev_insert_metadata_from_file tenant/dev import endpoints. The impact is bounded rather than a clean arbitrary-file-read: disclosure only succeeds for files whose contents parse into the JSON structure the importer expects and are subsequently written into a dataset, so non-conforming or binary files cannot be exfiltrated reliably and the practical exposure is limited to JSON-formatted material. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published an upstream fix (PR #19591 / commit aa78e8d) that removes the affected dev commands entirely.
Stored XSS in RAGFlow before 0.26.3 enables cross-user JavaScript execution through unsanitized agent pipeline node names rendered in a confirmation modal. An authenticated workspace member injects a payload into a DSL node name via the agent update endpoint; when a different workspace member opens the dataflow result and clicks 'Rerun from current step,' the payload executes in their browser, enabling session token theft and account takeover across the workspace trust boundary. No CISA KEV listing exists, but a public proof-of-concept is available and a vendor patch has been released as v0.26.3.
RAGFlow versions prior to 0.22.0 generate API keys and beta assistant/agent share tokens with a predictable scheme, letting anyone who holds a shared assistant or agent URL derive the owner's personal API key and take full control of their account. Exploitation is network-reachable and requires no authentication or user interaction (CVSS 4.0 8.9; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the only practical prerequisite being a valid share link from an instance that exposes shared assistants. Publicly available exploit code exists (the GitHub security advisory GHSA-9j5g-g4xm-57w7 is referenced as an exploit source) and a vendor fix is available in 0.22.0, but there is no confirmation of active exploitation (not in CISA KEV) at time of analysis.
Remote code execution in RAGFlow versions prior to 0.23.0 allows a low-privileged authenticated user (a normal login account) to run arbitrary system commands on the server host by abusing the frontend Canvas CodeExec component. The backend reads stdout returned by the code sandbox and passes it to Python's eval(), so attacker-controlled output is executed outside the intended sandbox isolation; no additional user interaction is required beyond the attacker's own session, and additional endpoints with missing access control or inverted permission logic widen the attack surface for chained exploitation. Publicly available exploit code exists and a vendor patch is available in 0.23.0, which replaces eval() with json.loads/ast.literal_eval; this is a genuine high-priority issue per our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.