InfiniFlow vulnerabilities
We track 14 vulnerabilities in InfiniFlow products across 2 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest InfiniFlow vulnerabilities
- 7.1 High severity
ragflow: Missing Authorization
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whethe
- 8.5 High severity
ragflow: Server-Side Request Forgery
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it
- 9.9 Critical severity
ragflow: Improper Neutralization of Special Elements Used in a Template Engine
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any norma
- 8.7 High severity
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These compon
- 9.8 Critical severity
ragflow: Improper Limitation of a Pathname to a Restricted Directory
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Co
- 9.8 Critical severity
ragflow: Generation of Predictable Numbers or Identifiers
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually
- 8.8 High severity
ragflow: Improper Neutralization of Special Elements used in an OS Command
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec com
- 9.8 Critical severity
RAGFlow: Improper Restriction of Excessive Authentication Attempts
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate lim
- 7.5 High severity
infiniflow/ragflow: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when
- 9.8 Critical severity
infiniflow/ragflow: Server-Side Request Forgery
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewin
- 9.8 Critical severity
infiniflow/ragflow: Deserialization of Untrusted Data
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without
- 9.8 Critical severity
ragflow: Improper Neutralization of Special Elements used in an SQL Command
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publicat
- 8.1 High severity
ragflow: Authorization Bypass Through User-Controlled Key
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tena
- 8.8 High severity
infiniflow/ragflow: Improper Control of Generation of Code
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various m