CVE-2026-51896 is a medium severity vulnerability in infiniflow ragflow version 0.25.3. It involves improper access control in the resume functionality within the connector_app.py file. This flaw can allow an attacker with some privileges to perform unauthorized cross-session or privilege-crossing operations, potentially impacting the integrity of the system.
Ragflow versions 0.24.0 and earlier have an improper access control vulnerability in the update_metadata_setting function within api/apps/kb_app.py. This flaw allows attackers to perform unauthorized cross-session or privilege-crossing operations depending on the exposed entry. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Infiniflow ragflow version 0.24.0 contains an incorrect access control vulnerability in the /v1/document/get/<doc_id> endpoint. This flaw allows users with limited privileges to access documents they should not be authorized to view. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No official patch or remediation information is currently available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
CVE-2026-24770 is a critical path traversal vulnerability in the MinerU parser component of the open-source RAG engine, RAGFlow (version 0.23.1 and earlier). The vulnerability, known as a 'Zip Slip', allows an attacker to craft a malicious ZIP archive that, when extracted by the vulnerable MinerUParser, can overwrite arbitrary files on the server. This can lead to remote code execution without requiring authentication or user interaction. The root cause is improper sanitization of filenames during ZIP extraction in the _extract_zip_no_root method. A patch has been committed to address this issue. Given its critical CVSS score of 9.8, exploitation could severely impact confidentiality, integrity, and availability of affected systems. European organizations using RAGFlow should urgently apply the fix and restrict ZIP file sources to trusted origins.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. The intended design was to "automatically convert string results into Python objects," but this effectively executes attacker-controlled code. Additional endpoints lack access control or contain inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. Version 0.23.0 contains a patch for the issue.
Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw.
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.