CVE-2026-93013mediumCWE-22

CVE-2026-93013: falha de média gravidade em infiniflow ragflow

RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ragflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
infiniflow · ragflow
CVEs relacionadas — infiniflow ragflow

No mesmo produto, das mais perigosas para as menos.

CVE-2026-24770CRITICALRAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParserEPSS 1.4%CVE-2025-69286HIGHRAGFlow has Predictable Token Generation Leading to Authentication Bypass VulnerabilityEPSS 0.8%CVE-2025-68700HIGHRAGFlow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-27135HIGHRAGFlow SQL Injection vulnerabilityEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2025-25282HIGHPotential Insecure Direct Object Reference (IDOR) vulnerability in ragflowEPSS 0.5%