Advisories · Technology
InfiniFlow RAGFlow.
Every CVE that names InfiniFlow RAGFlow among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
InfiniFlow RAGFlow Images API file_utils.py cross site scripting
- InfiniFlow RAGFlow
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
- InfiniFlow RAGFlow
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
- InfiniFlow RAGFlow
- Broken access control
- CVSS 7.1 High
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
- infiniflow ragflow
- Broken access control
- CVSS 5.3 Medium
RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
- infiniflow ragflow
- Path traversal
- CVSS 8.4 High
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
- infiniflow ragflow
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
- infiniflow ragflow
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
- infiniflow ragflow
- Code injection
- CVSS 8.7 High
RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
- infiniflow ragflow
- Command injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser
- infiniflow ragflow
- Path traversal
- CVSS 8.9 High
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
- infiniflow ragflow
- CWE-340
- CVSS 8.6 High
RAGFlow Remote Code Execution Vulnerability
- infiniflow ragflow
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Unlimited authentication attempts in infiniflow RAGFlow
- infiniflow RAGFlow
- Authentication bypass
- CVSS 6.5 Medium
SSRF in infiniflow/ragflow
- infiniflow/ragflow
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Improper Authentication in infiniflow/ragflow
- infiniflow/ragflow
- Authentication bypass
- CVSS 5.4 Medium
Stored Cross-site Scripting (XSS) in infiniflow/ragflow
- infiniflow/ragflow
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow
- infiniflow/ragflow
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Stored Cross-site Scripting (XSS) in infiniflow/ragflow
- infiniflow/ragflow
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Remote Code Execution in infiniflow/ragflow
- infiniflow/ragflow
- Insecure deserialization
- CVSS 8.1 High
Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow
- infiniflow/ragflow
- Broken access control
- CVSS 8.9 High
RAGFlow SQL Injection vulnerability
- infiniflow ragflow
- SQL injection
- CVSS 8.1 High
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
- infiniflow ragflow
- Broken access control
- CVSS 8.8 High
Remote Code Execution in infiniflow/ragflow
- infiniflow/ragflow
- Code injection