Vulnerabilities

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stor…

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset.

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0.

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list.

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base.

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution.

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding.

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.

The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability.