Server-Side Request Forgery in InfiniFlow RAGFlow Affected by Seafile Connector
CVE-2026-121927

5.3MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121927?

A vulnerability has been identified in InfiniFlow's RAGFlow that affects versions up to 0.27.3. This issue is associated with the function _account_get within the component Seafile Connector, located in common/data_source/seafile_connector.py. An attacker can manipulate the seafile_url argument, leading to potential server-side request forgery (SSRF) attacks that may be executed remotely. The exploit for this vulnerability has been disclosed publicly, and despite early outreach to the vendor regarding this issue, no response has been received.

Affected Version(s)

RAGFlow 0.27.0

RAGFlow 0.27.1

RAGFlow 0.27.2

References

https://vuldb.com/vuln/431037
vdb-entrytechnical-description
https://vuldb.com/vuln/431037/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-121927
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Alves (VulDB User)
VulDB CNA Team
.