CVE-2026-121928 - Vulnerability Details

- InfiniFlow RAGFlow Images API file_utils.py cross site scripting

Description

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.

Published: 2026-11-04

Score: 5.1 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the file api/utils/file_utils.py of the Images API and allows an attacker to inject malicious script into responses. An attacker can craft a request that forces the server to reflect user input without proper encoding, enabling cross‑site scripting that may lead to session hijacking or malicious payload execution in a victim’s browser. The weakness reflects CWE‑79 and involves an insecure code path that could also allow arbitrary code execution—CWE‑94.

Affected Systems

InfiniFlow RAGFlow, all releases up to 0.27.2, including the Images API component. The issue is fixed in release 0.27.3 and is referenced by commit 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c.

Risk and Exploitability

The CVSS score of 5.1 indicates medium severity. EPSS is not available, but the advisory notes that the exploit is publicly available and may be used. The vulnerability can be triggered remotely by sending a crafted request to the Images API. It is not listed in the CISA KEV catalog, although the cross‑site scripting impact remains significant for systems exposing the API to untrusted clients.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

InfiniFlow

RAGFlow

affected

Version	Status	Constraints
`0.27.0`	affected	—
`0.27.1`	affected	—
`0.27.2`	affected	—
`0.27.3`	unaffected	—

No data.

Vendor Product Confidence Versions

Infiniflow

Ragflow

95%

Version	Status	Scheme	Platform
`0.27.0`	affected	semver	—
`0.27.1`	affected	semver	—
`0.27.2`	affected	semver	—
`0.27.3`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade RAGFlow to version 0.27.3 or later, applying the patch identified by commit 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c.
If an immediate upgrade is not possible, restrict access to the Images API to trusted networks or behind a firewall to prevent unauthenticated users from sending malicious requests.
Validate and sanitize all user‑supplied parameters that are processed by the Images API before they are included in responses to guard against future injection attempts.

Generated by OpenCVE AI on November 4, 2026 at 19:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/infiniflow/ragflow/
https://github.com/infiniflow/ragflow/commit/9ea0246f8d453a144fb4f903d163b2ba6b91ed2c
https://github.com/infiniflow/ragflow/pull/19818
https://github.com/infiniflow/ragflow/releases/tag/v0.27.3
https://vuldb.com/cve/CVE-2026-121928
https://vuldb.com/submit/1023352
https://vuldb.com/vuln/431040
https://vuldb.com/vuln/431040/cti

History

Wed, 04 Nov 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.
Title		InfiniFlow RAGFlow Images API file_utils.py cross site scripting
First Time appeared		Infiniflow Infiniflow ragflow
Weaknesses		CWE-79 CWE-94
CPEs		cpe:2.3:a:infiniflow:ragflow::::::::
Vendors & Products		Infiniflow Infiniflow ragflow
References		https://github.com/infiniflow/ragflow/ https://github.com/infiniflow/ragflow/commit/9ea0246f8d453a144fb4f903d163b2ba6b91ed2c https://github.com/infiniflow/ragflow/pull/19818 https://github.com/infiniflow/ragflow/releases/tag/v0.27.3 https://vuldb.com/cve/CVE-2026-121928 https://vuldb.com/submit/1023352 https://vuldb.com/vuln/431040 https://vuldb.com/vuln/431040/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Infiniflow Ragflow

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-11-04T18:00:30.206Z

Updated: 2026-11-04T18:00:30.206Z

Reserved: 2026-11-04T11:33:44.309Z

Link: CVE-2026-121928

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-11-04T19:17:32.387

Modified: 2026-11-04T19:17:32.573

Link: CVE-2026-121928

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-04T19:45:14Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object