infiniflow vulnerabilities
24 published CVEs name infiniflow among the affected products.
- 24Published CVEs24 of them scored
- 13Last 12 monthspublished in the last year
- 4Critical9 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-49951
RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter
infiniflow · ragflow
Medium5.3 - CVE-2026-121928
InfiniFlow RAGFlow Images API file_utils.py cross site scripting
InfiniFlow · RAGFlow
Medium5.1 - CVE-2026-121927
InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
InfiniFlow · RAGFlow
Medium5.3 - CVE-2026-121585
InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
InfiniFlow · RAGFlow
Medium5.3 - CVE-2026-119337
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
infiniflow · ragflow
High7.1 - CVE-2026-93013
RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
infiniflow · ragflow
Medium5.3 - CVE-2026-75898
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
infiniflow · ragflow
High8.4 - CVE-2026-58579
RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
infiniflow · ragflow
Medium5.1 - CVE-2026-45312
RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
infiniflow · ragflow
Critical9.9 - CVE-2026-28797
RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
infiniflow · ragflow
High8.7