SQL Injection Vulnerability in RAGFlow Open-Source Engine

CVE-2025-27135

What is CVE-2025-27135?

RAGFlow, an open-source Retrieval-Augmented Generation engine, is susceptible to SQL injection in versions up to 0.15.1. The vulnerability lies in the ExeSQL component, which improperly handles SQL statements. This flaw allows malicious actors to execute unauthorized SQL queries by manipulating input data sent to the database. As of the latest information, no patched version has been released to mitigate this critical issue, exposing users to potential data breaches and unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References