CVE-2024-12450

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12450
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12450.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12450
Published
2025-03-20T10:11:05.133Z
Modified
2026-08-12T03:51:29.488294230Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow
Details

In infiniflow/ragflow versions 0.12.0, the web_crawl function in document_app.py contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12450.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "@huntr_ai"
}
References

Affected packages

Git / github.com/infiniflow/ragflow

Affected ranges

Type
GIT
Repo
https://github.com/infiniflow/ragflow
Events
Introduced
92a4a095c922690b31e9ef557b708d3920d092a9
Fixed
3faae0b2c2f8a26233ee1442ba04874b3406f6e9
Database specific
Show details 
{
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:infiniflow:ragflow:0.12.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.12.0"
        },
        {
            "last_affected": "0.12.0"
        }
    ]
}

Affected versions

0.*
0.12.0
v0.*
v0.12.0
v0.13.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12450.json"