Remote Code Execution Vulnerability in RagFlow by Infiniflow
CVE-2024-12433

9.8CRITICAL

Key Information:

Vendor

Infiniflow

Status
Infiniflow/ragflow
Vendor
CVE Published:
20 March 2025

What is CVE-2024-12433?

A security issue in RagFlow versions v0.12.0 enables attackers to execute arbitrary code remotely due to the use of a hard-coded authentication key. This allows unauthorized access to the RPC server, facilitating the execution of malicious commands. Furthermore, the server’s handling of incoming data via pickle.loads() introduces a significant risk, as it can be exploited for remote code execution. The vulnerability has been addressed in version 0.14.0, emphasizing the importance of updating to this version to ensure system security.

Affected Version(s)

infiniflow/ragflow < 0.14.0

References

https://huntr.com/bounties/8a1465af-09e4-42af-9e54-0b70e7...
https://github.com/infiniflow/ragflow/commit/49494d4e3c8f...

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-12433 : Remote Code Execution Vulnerability in RagFlow by Infiniflow