CRITICAL🇵🇱 Wersja polska

CVE-2026-24770

CVSS 9.8v3.1pub. 2026-01-27upd. 2026-01-30

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.

🤖 AI Analysis
How it works

The MinerUParser class downloads and extracts ZIP archives from an external source specified by the mineru_server_url parameter. The _extract_zip_no_root function responsible for extraction does not perform sanitization of filenames contained in the ZIP archive. An attacker can provide a malicious ZIP archive containing paths with path traversal sequences (e.g., '../../'), which allows writing files outside the intended target directory and overwriting arbitrary system or application files, leading to code execution.

Impact

An attacker without any authentication can overwrite arbitrary files on the server, which consequently enables full remote code execution (RCE) and takeover of server control.

Mitigation & patch

RAGFlow should be updated to a version containing the fix introduced in commit 64c75d558e4a17a4a48953b4c201526431d8338f. Details available in vendor references (GitHub Security Advisory GHSA-v7cf-w7gj-pgf4).

Who is affected

Infiniflow RAGFlow version 0.23.1 and likely earlier versions

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Infiniflow Ragflow

    APP
    Infiniflow
    ≤ 0.23.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEPath Traversal
CWE
References

Related vulnerabilities

CVE-2025-48187CRITICAL9.1PL ✓ten sam produkt

Przejęcie konta w RAGFlow poprzez brute-force kodów weryfikacyjnych

CVE-2024-12450CRITICAL9.8PL ✓ten sam produkt

Infiniflow RAGflow: SSRF, Arbitrary File Read i RCE w funkcji web_crawl

CVE-2024-12433CRITICAL9.8PL ✓ten sam produkt

RCE w Infiniflow RagFlow — statyczny klucz AuthKey i niebezpieczna deserializacja pickle

CVE-2026-28797HIGH8.7ten sam produkt

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-...

CVE-2025-68700HIGH8.6ten sam produkt

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-priv...