infiniflow

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset.

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py).

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding.

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying.

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stor…

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base.

A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080).

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2.

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserv…

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list.

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absol…

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated…

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2.