Priority LOW 24
RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00252 · Published 2026-11-06 · Fixed in 0.27.0 CWE-918
Priority LOW 23
A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00208 · Published 2026-11-04 · Fixed in 0.27.3 CWE-79
Priority LOW 23
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00201 · Published 2026-11-04 · No fix listed CWE-918
Priority MEDIUM 57
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00244 · Published 2026-11-03 · No fix listed CWE-285
Priority MEDIUM 64
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00335 · Published 2026-10-30 · Fixed in 0.27.3 CWE-862
Priority LOW 25
RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absol…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00511 · Published 2026-09-17 · No fix listed CWE-22
Priority HIGH 70
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py).
CVSS 4.0HIGH 8.4· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-08-18 · Fixed in 0.26.3 CWE-918
Priority MEDIUM 56
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserv…
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00298 · Published 2026-07-02 · Fixed in 0.26.3 CWE-79
Priority HIGH 76
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00447 · Published 2026-05-29 · No fix listed CWE-1336
Priority HIGH 73
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00583 · Published 2026-04-03 · No fix listed CWE-1336
Priority HIGH 82
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01432 · Published 2026-01-27 · No fix listed CWE-22
Priority HIGH 80
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00797 · Published 2025-12-31 · Fixed in 0.22.0 CWE-340
Priority HIGH 72
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00724 · Published 2025-12-31 · Fixed in 0.23.0 CWE-78
Priority MEDIUM 60
Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stor…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00328 · Published 2025-07-22 · No fix listed CWE-79
Priority HIGH 82
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00546 · Published 2025-05-17 · No fix listed CWE-307
Priority HIGH 66
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0066 · Published 2025-03-20 · No fix listed CWE-918
Priority MEDIUM 53
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0055 · Published 2025-03-20 · No fix listed CWE-306
Priority MEDIUM 58
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00398 · Published 2025-03-20 · No fix listed CWE-79
Priority HIGH 75
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01323 · Published 2025-03-20 · Fixed in 0.14.0 CWE-918
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080).
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00509 · Published 2025-03-20 · No fix listed CWE-79
Priority HIGH 82
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01692 · Published 2025-03-20 · Fixed in 0.14.0 CWE-502
Priority MEDIUM 62
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00694 · Published 2025-03-20 · No fix listed CWE-639
Priority HIGH 80
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00621 · Published 2025-02-25 · No fix listed CWE-89
Priority HIGH 70
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding.
CVSS 3.0HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00486 · Published 2025-02-21 · No fix listed CWE-639
Priority HIGH 72
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2024-12-09 · No fix listed CWE-125
Load more
THREATIST.IORead the docs