CVE-2026-93013 infiniflow CVE debrief

Who should care

Defenders responsible for RAGFlow deployments, especially those using version 0.27.2 or earlier, should assess their exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-93013 is a path traversal vulnerability in RAGFlow through version 0.27.2 that allows authenticated attackers to read arbitrary files. Defenders should prioritize verifying the vulnerability in their deployments, securing access tokens, and monitoring for suspicious activity.

• Verification of RAGFlow version and potential exposure to unauthorized file reading
• Securing access tokens to prevent exploitation by authenticated attackers
• Monitoring for suspicious activity on affected endpoints

Technical summary

The vulnerability exists in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints of RAGFlow through version 0.27.2. An authenticated attacker can exploit this vulnerability by supplying absolute file paths in the file_path parameter to read arbitrary files accessible to the service. The disclosure is limited to files matching expected JSON structures that are then written to datasets.

Defensive priority

Defenders should prioritize verifying the vulnerability in their RAGFlow deployments, especially if they have not upgraded from version 0.27.2 or earlier, and ensure that access tokens are properly secured.

Recommended defensive actions

• Verify RAGFlow version and ensure it is upgraded from 0.27.2 or earlier
• Review and secure access tokens used for authentication
• Monitor for suspicious activity on dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints
• Perform vulnerability scanning to identify potential exposures
• Implement additional logging and monitoring for affected endpoints
• Review and update incident response plans to address potential exploitation
• Conduct a thorough risk assessment to identify and mitigate potential impacts

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in RAGFlow. The vulnerability is confirmed to exist in version 0.27.2 and earlier. However, the exact scope of affected versions and potential impact on various deployment contexts require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.