RAGFlow at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 4 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 1 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 1 | 1 |
| Dec 2025 | 2 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 1 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 2 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
16 results · Feed
-
Medium 6.3
RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter
RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_k…
-
Low 3.5
InfiniFlow RAGFlow Images API file_utils.py cross site scripting
A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attac…
-
Medium 6.3
InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads …
-
Medium 4.3
InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in …
-
High 7.1
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks wheth…
-
Medium 4.3
RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path paramet…
-
High 8.5CVE-2026-75898 Public exploit
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes i…
-
Medium 5.4
RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow…
-
Critical 9.9
RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any norm…
-
High 8.7CVE-2026-28797 Public exploit
RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These compo…
-
Critical 9.8
RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote C…
-
High 8.9CVE-2025-69286 Public exploit
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutuall…
-
High 8.6
RAGFlow Remote Code Execution Vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec co…
-
Critical 9.1
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against…
-
High 8.9
RAGFlow SQL Injection vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publica…
-
High 8.1
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list ten…