Threat Intelligence Database

CVE-2026-75898 is a server-side request forgery (SSRF) vulnerability in the RAGFlow product from infiniflow, affecting versions before 0.26.3. The vulnerability exists in the agent workflow "Invoke" component, which improperly constructs outbound request URLs without validating or restricting them. This allows an attacker who can create or trigger an agent to make the server perform unauthorized requests to internal network resources, including loopback, link-local, and RFC 1918 addresses, as well as cloud instance metadata endpoints. The response from these requests is returned as the component output, potentially exposing sensitive internal information. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4. A fix is available in version 0.26.3 and later.

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.

CVE-2026-24770 is a critical path traversal vulnerability in the MinerU parser component of the open-source RAG engine, RAGFlow (version 0.23.1 and earlier). The vulnerability, known as a 'Zip Slip', allows an attacker to craft a malicious ZIP archive that, when extracted by the vulnerable MinerUParser, can overwrite arbitrary files on the server. This can lead to remote code execution without requiring authentication or user interaction. The root cause is improper sanitization of filenames during ZIP extraction in the _extract_zip_no_root method. A patch has been committed to address this issue. Given its critical CVSS score of 9.8, exploitation could severely impact confidentiality, integrity, and availability of affected systems. European organizations using RAGFlow should urgently apply the fix and restrict ZIP file sources to trusted origins.

CriticalVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-24770#cwe-22

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-69286#cwe-340

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. The intended design was to "automatically convert string results into Python objects," but this effectively executes attacker-controlled code. Additional endpoints lack access control or contain inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. Version 0.23.0 contains a patch for the issue.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-68700#cwe-78

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-51462

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2024-12869#cwe-306

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-53450

The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2024-10131#cwe-94