Vendor

    Infiniflow

    25 known vulnerabilities in products by Infiniflow, 0 of them actively exploited (CISA KEV).

    Key figures

    25

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Infiniflow
    CriticalCVE-2026-24770

    RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser

    		9.8
    CriticalCVE-2024-12433

    Remote Code Execution in infiniflow/ragflow

    		9.8
    CriticalCVE-2025-69286

    RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

    		9.8
    HighCVE-2024-10131

    Remote Code Execution in infiniflow/ragflow

    		8.8
    CriticalCVE-2024-12450

    RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

    		6.5
    HighCVE-2025-68700

    RAGFlow Remote Code Execution Vulnerability

    		8.8
    CriticalCVE-2026-45312

    RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution

    		9.9
    HighCVE-2026-28797

    RAGFlow: OS Command Injection

    		8.8
    CriticalCVE-2025-27135

    RAGFlow SQL Injection vulnerability

    		9.8
    HighCVE-2026-75898

    RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

    		8.5
    HighCVE-2026-119337

    RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization

    		7.1
    CriticalCVE-2025-48187

    Infiniflow RAGFlow: Improper Restriction of Excessive Authentication Attempts

    		9.1
    HighCVE-2024-12880

    Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow

    		8.1
    MediumCVE-2026-93013

    RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

    		4.3
    HighCVE-2025-25282

    Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow

    		8.1
    HighCVE-2024-12779

    SSRF in infiniflow/ragflow

    		6.5
    MediumCVE-2026-121927

    InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery

    		6.3
    HighCVE-2024-53450

    RAGFlow: Improper Access Control

    		7.5
    MediumCVE-2026-121585

    InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization

    		4.3
    MediumCVE-2026-121928

    InfiniFlow RAGFlow Images API file_utils.py cross site scripting

    		3.5
    MediumCVE-2026-58579

    RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

    		5.4
    MediumCVE-2024-12870

    Stored Cross-site Scripting (XSS) in infiniflow/ragflow

    		5.4
    MediumCVE-2024-12869

    Improper Authentication in infiniflow/ragflow

    		4.3
    MediumCVE-2025-51462

    RAGFlow: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2024-12871

    Stored Cross-site Scripting (XSS) in infiniflow/ragflow

    		5.4

    Products

    Products by Infiniflow
    RAGFlow240
    Infiniflow/ragflow80