What’s Vulnerable › Products
infiniflow ragflow vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your infiniflow ragflow version is affected
Latest infiniflow ragflow vulnerabilities
- CVE-2026-119337 — RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization (CVSS 7.1)
- CVE-2026-93013 — RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal (CVSS 4.3)
- CVE-2026-75898 — RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component (CVSS 8.5)
- CVE-2026-58579 — RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name (CVSS 5.4)
- CVE-2026-45312 — RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution (CVSS 9.9)
- CVE-2026-28797 — RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component (CVSS 8.8)
- CVE-2026-24770 — RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser (CVSS 9.8)
- CVE-2025-69286 — RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability (CVSS 9.8)
- CVE-2025-68700 — RAGFlow Remote Code Execution Vulnerability (CVSS 8.8)
- CVE-2025-51462 — (CVSS 6.1)
- CVE-2025-48187 — (CVSS 9.8)
- CVE-2024-12880 — Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow (CVSS 6.5)
- CVE-2024-12871 — Stored Cross-site Scripting (XSS) in infiniflow/ragflow (CVSS 5.4)
- CVE-2024-12870 — Stored Cross-site Scripting (XSS) in infiniflow/ragflow (CVSS 5.4)
- CVE-2024-12869 — Improper Authentication in infiniflow/ragflow (CVSS 4.3)
- CVE-2024-12779 — SSRF in infiniflow/ragflow (CVSS 7.5)
- CVE-2024-12450 — RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow (CVSS 9.8)
- CVE-2024-12433 — Remote Code Execution in infiniflow/ragflow (CVSS 9.8)
- CVE-2025-27135 — RAGFlow SQL Injection vulnerability (CVSS 9.8)
- CVE-2025-25282 — Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow (CVSS 8.1)
- CVE-2024-53450 — (CVSS 7.5)
- CVE-2024-10131 — Remote Code Execution in infiniflow/ragflow (CVSS 8.8)