Read the docs

infiniflow

Records26All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

infiniflow records in CISA KEV

No infiniflow vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ragflow 16 records HIGH

Records

16 records in Ragflow · all components

TI-2025-30545 CVE-2025-48187 · GHSA-f87m-rx58-p97v

Missing brute-force protection in infiniflow RAGFlow

Priority HIGH 82

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00546 Published 2025-05-17 No fix listed CWE-307
TI-2024-11535 CVE-2024-12433 · GHSA-wr4v-pc76-3q4p

Remote Code Execution in infiniflow/ragflow

Priority HIGH 82

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01692 Published 2025-03-20 Fixed in 0.14.0 CWE-502
TI-2025-19992 CVE-2025-27135

RAGFlow SQL Injection vulnerability

Priority HIGH 80

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00621 Published 2025-02-25 No fix listed CWE-89
TI-2024-09392 CVE-2024-10131 · GHSA-3rqf-vgwx-39xx

Remote Code Execution in infiniflow/ragflow

Priority HIGH 73

The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01144 Published 2024-10-19 No fix listed CWE-94
TI-2025-42171 CVE-2025-68700

RAGFlow Remote Code Execution Vulnerability

Priority HIGH 72

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00724 Published 2025-12-31 Fixed in 0.23.0 CWE-78
TI-2024-11843 CVE-2024-12779 · GHSA-96mw-rfcv-484q

SSRF in infiniflow/ragflow

Priority HIGH 66

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0066 Published 2025-03-20 No fix listed CWE-918
TI-2025-32334 CVE-2025-51462 · GHSA-92rv-8r2q-hvm7

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in…

Priority MEDIUM 60

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stor…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00328 Published 2025-07-22 No fix listed CWE-79
TI-2024-11927 CVE-2024-12871 · GHSA-hw3w-6mhf-rh8m

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Priority MEDIUM 58

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00398 Published 2025-03-20 No fix listed CWE-79
TI-2024-11925 CVE-2024-12869 · GHSA-3c45-rpmq-6gfj

Improper Authentication in infiniflow/ragflow

Priority MEDIUM 53

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0055 Published 2025-03-20 No fix listed CWE-306
Open these records in search →