Known Vulnerabilities for Ragflow by Infiniflow
Listed below are 3 of the newest known vulnerabilities associated with "Ragflow" by "Infiniflow".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-93013 json | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_fro... | Not Provided | 2026-09-17 | 2026-09-21 |
| CVE-2026-75898 json | RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/co... | Not Provided | 2026-08-18 | 2026-08-21 |
| CVE-2026-51897 json | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an ... | Not Provided | 2026-10-01 | 2026-10-05 |
| CVE-2026-51896 json | infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed en... | Not Provided | 2026-10-01 | 2026-10-05 |
| CVE-2026-51895 json | Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the e... | Not Provided | 2026-10-01 | 2026-10-02 |
| CVE-2026-51894 json | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-select... | Not Provided | 2026-10-01 | 2026-10-05 |
| CVE-2026-51893 json | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a... | Not Provided | 2026-10-01 | 2026-10-05 |
| CVE-2026-51892 json | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/ |
Not Provided | 2026-10-01 | 2026-10-05 |
| CVE-2026-28797 json | Not Provided | 2026-04-03 | 2026-07-24 | |
| CVE-2025-69286 json | Not Provided | 2025-12-31 | 2026-09-23 |