Threats tagged 'ghsa-6c99-p4pm-w7p6'

A server-side request forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.3 in the _account_get function of the Seafile Connector component. This vulnerability allows remote attackers to manipulate the seafile_url argument, potentially causing unauthorized requests from the server. The vulnerability has a CVSS score of 6.3 (medium severity). Public exploit code has been disclosed, but no vendor response or patch is currently available.