Cross Site Scripting Vulnerability in InfiniFlow RAGFlow Product
CVE-2026-121928

5.1MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121928?

A Cross Site Scripting vulnerability has been found in the InfiniFlow RAGFlow Images API component, specifically in the file api/utils/file_utils.py. This flaw permits attackers to execute malicious scripts remotely by manipulating input to the affected component. An upgrade to version 0.27.3 is strongly advised to remediate this issue, as the exploit is publicly accessible.

Affected Version(s)

RAGFlow 0.27.0

RAGFlow 0.27.1

RAGFlow 0.27.2

References

https://vuldb.com/vuln/431040
vdb-entry
https://vuldb.com/vuln/431040/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-121928
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Alves (VulDB User)
.