Threat Intelligence Database

RAGFlow version 0.24.0 has an improper access control vulnerability in the get_dataset function within the api/apps/evaluation_app component. This flaw could allow an attacker to execute attacker-controlled code or commands depending on the exposed entry point.

Infiniflow ragflow version 0.25.3 contains an improper access control vulnerability in the resume functionality located in api/apps/connector_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations depending on the exposed entry point. No CVSS score or patch information is currently available.

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

Infiniflow ragflow version 0.24.0 has an incorrect access control vulnerability in the /v1/document/get/<doc_id> endpoint. This flaw could allow unauthorized access to documents by bypassing intended access restrictions.

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query.

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.

CVE-2026-24770 is a critical path traversal vulnerability in the MinerU parser component of the open-source RAG engine, RAGFlow (version 0.23.1 and earlier). The vulnerability, known as a 'Zip Slip', allows an attacker to craft a malicious ZIP archive that, when extracted by the vulnerable MinerUParser, can overwrite arbitrary files on the server. This can lead to remote code execution without requiring authentication or user interaction. The root cause is improper sanitization of filenames during ZIP extraction in the _extract_zip_no_root method. A patch has been committed to address this issue. Given its critical CVSS score of 9.8, exploitation could severely impact confidentiality, integrity, and availability of affected systems. European organizations using RAGFlow should urgently apply the fix and restrict ZIP file sources to trusted origins.

CriticalVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-24770#cwe-22

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-69286#cwe-340