A Zip Slip vulnerability exists in the MinerU parser of RAGFlow, where extraction logic does not sanitize filenames inside ZIP archives. When a malicious ZIP archive is delivered via the mineru_server_url endpoint, the application extracts files without ensuring they reside within an intended directory, allowing an attacker to overwrite arbitrary files on the server. If critical executables or configuration files are overwritten, the attacker can gain remote code execution capability.

Infiniflow RAGFlow, versions 0.23.1 and earlier, are affected. The issue originates in the MinerUParser class responsible for pulling and extracting ZIP archives from external sources.

The vulnerability has a CVSS base score of 9.8, indicating critical severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation relative to current threat landscape, and the vulnerability is not yet listed in CISA’s KEV catalog. Nonetheless, the required conditions—access to the mineru_server_url endpoint and the ability to host a crafted ZIP archive—are commonly available in many deployments, making remote exploitation feasible for attackers who can control or compromise the external source.