infiniflow vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202512
3. 202611

Newest CVEs

• CVE-2026-49951

  RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

  infiniflow · ragflow

  Medium5.3
• CVE-2026-121928

  InfiniFlow RAGFlow Images API file_utils.py cross site scripting

  InfiniFlow · RAGFlow

  Medium5.1
• CVE-2026-121927

  InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery

  InfiniFlow · RAGFlow

  Medium5.3
• CVE-2026-121585

  InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization

  InfiniFlow · RAGFlow

  Medium5.3
• CVE-2026-119337

  RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization

  infiniflow · ragflow

  High7.1
• CVE-2026-93013

  RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

  infiniflow · ragflow

  Medium5.3
• CVE-2026-75898

  RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

  infiniflow · ragflow

  High8.4
• CVE-2026-58579

  RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

  infiniflow · ragflow

  Medium5.1
• CVE-2026-45312

  RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution

  infiniflow · ragflow

  Critical9.9
• CVE-2026-28797

  RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

  infiniflow · ragflow

  High8.7