CVE-2026-93013 is a path traversal vulnerability in infiniflow's RAGFlow product, affecting versions up to and including 0.27.2. Authenticated attackers with valid access tokens can exploit missing validation on the file_path parameter in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints to read arbitrary files accessible to the service. The vulnerability allows reading files by supplying absolute file paths, but disclosure is constrained to files that match expected JSON structures processed by the service.

An attacker with valid credentials can read arbitrary files on the system that the service has access to, potentially exposing sensitive data. However, the impact is limited by the requirement that the files must match expected JSON structures to be processed and disclosed. There is no indication of privilege escalation, remote code execution, or denial of service from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious activity involving file_path parameters. Implement additional input validation or filtering on file paths if possible.