SQL Injection Vulnerability in RAGFlow Open-Source Engine

CVE-2025-27135

Summary

RAGFlow, an open-source Retrieval-Augmented Generation engine, is susceptible to SQL injection in versions up to 0.15.1. The vulnerability lies in the ExeSQL component, which improperly handles SQL statements. This flaw allows malicious actors to execute unauthorized SQL queries by manipulating input data sent to the database. As of the latest information, no patched version has been released to mitigate this critical issue, exposing users to potential data breaches and unauthorized access.

References