Read the docs
TI-2026-85116 Aliases CVE-2026-121927GHSA-6c99-p4pm-w7p6

Server-side request forgery in InfiniFlow RAGFlow Seafile connector

Priority LOW 23CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

InfiniFlow RAGFlow up to 0.27.3 contains a server-side request forgery flaw (CWE-918) in the _account_get function of the Seafile connector. Manipulating the seafile_url argument makes the server send requests to destinations chosen by the attacker. A remote attacker with low privileges can trigger it. The exploit has been publicly disclosed and may be used.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

EPSS 0.00201 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
infiniflowRAGFlow0.27.0; 0.27.1; 0.27.2; 0.27.3—No fix listedCNA
  • RAGFlow Vendorinfiniflow Affected 0.27.0; 0.27.1; 0.27.2; 0.27.3 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*——infiniflow
  • cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* Versions — — ·infiniflow

Remediation

The sources list no fixed version for InfiniFlow RAGFlow.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121927
  2. 2026-11-04 Alias added: GHSA-6c99-p4pm-w7p6

References

—

  • TI-2026-19971 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVSS 3.1CRITICAL 9.8
  • TI-2025-30545 Missing brute-force protection in infiniflow RAGFlow CVSS 3.1CRITICAL 9.8
  • TI-2024-11535 Remote Code Execution in infiniflow/ragflow CVSS 3.0CRITICAL 9.8
  • TI-2025-42731 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVSS 4.0HIGH 8.9
  • TI-2025-19992 RAGFlow SQL Injection vulnerability CVSS 4.0HIGH 8.9
  • TI-2026-33111 RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution CVSS 3.1CRITICAL 9.9
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences