Missing brute-force protection in infiniflow RAGFlow
Priority HIGH 82CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.
Summary
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| infiniflow | RAGFlow | up to 0.18.1 | — | No fix listed | CNA |
- RAGFlow Vendorinfiniflow Affected up to 0.18.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* | up to 0.18.1 | Vulnerable | infiniflow |
- cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* Versions up to 0.18.1 Vulnerable ·infiniflow
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48187
- 2026-10-03 Alias added: GHSA-f87m-rx58-p97v
References
More infiniflow Ragflow vulnerabilities
- TI-2026-19971 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVSS 3.1CRITICAL 9.8
- TI-2024-11535 Remote Code Execution in infiniflow/ragflow CVSS 3.0CRITICAL 9.8
- TI-2025-42731 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVSS 4.0HIGH 8.9
- TI-2025-19992 RAGFlow SQL Injection vulnerability CVSS 4.0HIGH 8.9
- TI-2024-11552 RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow CVSS 3.1CRITICAL 9.8
- TI-2026-22991 Improper input validation in infiniflow ragflow CVSS 4.0HIGH 8.7
Sources
- CVE-2025-48187 · CVE Program
- CVE-2025-48187 · NVD
- FIRST EPSS
- GHSA-f87m-rx58-p97v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences