Infiniflow Ragflow vulnerabilities

• infiniflow ragflow RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter CVE-2026-49951 5.3 MediumNovember 6, 2026
• infiniflow ragflow InfiniFlow RAGFlow Images API file_utils.py cross site scripting CVE-2026-121928 5.1 MediumNovember 4, 2026
• infiniflow ragflow InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery CVE-2026-121927 5.3 MediumNovember 4, 2026
• infiniflow ragflow InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization CVE-2026-121585 5.3 MediumNovember 3, 2026
• infiniflow ragflow RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization CVE-2026-119337 7.1 HighOctober 30, 2026
• infiniflow ragflow RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal CVE-2026-93013 5.3 MediumSeptember 17, 2026
• infiniflow ragflow RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component CVE-2026-75898 Public exploit 8.4 HighAugust 18, 2026
• infiniflow ragflow RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name CVE-2026-58579 5.1 MediumJuly 2, 2026
• infiniflow ragflow RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution CVE-2026-45312 9.9 CriticalMay 29, 2026
• infiniflow ragflow RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component CVE-2026-28797 Public exploit 8.7 HighApril 3, 2026
• infiniflow ragflow RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVE-2026-24770 9.8 CriticalJanuary 27, 2026
• infiniflow ragflow RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVE-2025-69286 Public exploit 8.9 HighDecember 31, 2025
• infiniflow ragflow RAGFlow Remote Code Execution Vulnerability CVE-2025-68700 8.6 HighDecember 31, 2025
• infiniflow ragflow Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17... CVE-2025-51462 6.1 MediumJuly 22, 2025
• infiniflow ragflow RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute... CVE-2025-48187 9.1 CriticalMay 17, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more SSRF in infiniflow/ragflow CVE-2024-12779 6.5 MediumMarch 20, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more Improper Authentication in infiniflow/ragflow CVE-2024-12869 4.3 MediumMarch 20, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more Stored Cross-site Scripting (XSS) in infiniflow/ragflow CVE-2024-12871 5.4 MediumMarch 20, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow CVE-2024-12450 6.5 MediumMarch 20, 2025
• infiniflow infiniflow/ragflow Stored Cross-site Scripting (XSS) in infiniflow/ragflow CVE-2024-12870 5.4 MediumMarch 20, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more Remote Code Execution in infiniflow/ragflow CVE-2024-12433 9.8 CriticalMarch 20, 2025
• infiniflow infiniflow/ragflow, ragflow +1 more Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow CVE-2024-12880 8.1 HighMarch 20, 2025
• infiniflow ragflow RAGFlow SQL Injection vulnerability CVE-2025-27135 8.9 HighFebruary 25, 2025
• infiniflow ragflow Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow CVE-2025-25282 8.1 HighFebruary 21, 2025
• infiniflow ragflow RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized... CVE-2024-53450 7.5 HighDecember 9, 2024
• infiniflow infiniflow/ragflow, ragflow +1 more Remote Code Execution in infiniflow/ragflow CVE-2024-10131 8.8 HighOctober 19, 2024