CVE-2025-68700
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
RAGFlow is an open-source RAG engine. In versions prior to 0.23.0, a low-privileged authenticated user can execute arbitrary system commands on the server host via the Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. Additional endpoints lack access control or have inverted permission logic, expanding the attack surface.
Risk Assessment
An attacker could gain full control of the server by executing arbitrary commands, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Upgrade RAGFlow to version 0.23.0 or later immediately, and restrict user account access.
Other vulnerabilities in RAGFlow
See all- CVE-2026-45312Critical
RAGFlow 0.24.0 and earlier contain a Jinja2 template injection vulnerability in the prompt generator (rag/prompts/generator.py). This allows any authenticated user to execute arbitrary OS commands on the server.
- CVE-2026-24770Critical
RAGFlow is an open-source RAG engine. In version 0.23.1 and possibly earlier, the MinerU parser contains a 'Zip Slip' vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch.
- CVE-2025-69286Critical
RAGFlow is an open-source RAG engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta token generation process allows these tokens to be mutually derivable. Both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
- CVE-2026-93013Medium
RAGFlow through version 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.
- CVE-2026-75898High
RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.
- CVE-2026-58579Medium
An XSS vulnerability in RAGFlow before 0.26.3 allows an authenticated user to inject arbitrary JavaScript via the agent pipeline (DSL) node name. The code executes in the session of another workspace member who opens the dataflow result and clicks the rerun button.
- CVE-2026-28797High
RAGFlow versions up to 0.24.0 contain a Server-Side Template Injection (SSTI) vulnerability in the TextProcessing and Message components. It allows an authenticated user to execute arbitrary OS commands on the server via unsafe Jinja2 template rendering.
Original NVD description (English source)
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. The intended design was to "automatically convert string results into Python objects," but this effectively executes attacker-controlled code. Additional endpoints lack access control or contain inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. Version 0.23.0 contains a patch for the issue.