CVE-2026-121927Medium· 6.3▾ SunlitA vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argum…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
RAGFlow 0.27.0RAGFlow 0.27.1RAGFlow 0.27.2RAGFlow 0.27.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75898High· 8.5RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py)
CVE-2026-121928Low· 3.5InfiniFlow RAGFlow Images API file_utils.py cross site scripting
CVE-2026-121585Medium· 4.3InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
CVE-2026-119337High· 7.1RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
CVE-2026-93013Medium· 4.3RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in…
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents