CVE-2026-93013CWE-22path-traversal

CVE-2026-93013

Medium · published September 17, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-17T20:18Z
References (6)
https://github.com/infiniflow/ragflow · [email protected]https://github.com/infiniflow/ragflow/blob/v0.27.2/internal/handler/tenant.go#L360 · [email protected]https://github.com/infiniflow/ragflow/commit/aa78e8d224e0eab818d9fcd46f8791ebd73831bd · [email protected]https://github.com/infiniflow/ragflow/issues/19122 · [email protected]https://github.com/infiniflow/ragflow/pull/19591 · [email protected]https://www.vulncheck.com/advisories/ragflow-through-0.27.2-tenant-import-endpoints-path-traversal · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 15:16Z
    RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
    cvelistv5