CVE-2026-24770

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24770

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24770.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24770

Aliases

GHSA-v7cf-w7gj-pgf4

Published

2026-01-27T21:51:44.874Z

Modified

2026-02-01T05:52:53.861458Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser

Details

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineruserverurl). The extraction logic in _extract_zip_no_root fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24770.json"
}

References

Affected packages

Git / github.com/infiniflow/ragflow

Affected ranges

Type: GIT
Repo: https://github.com/infiniflow/ragflow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

64c75d558e4a17a4a48953b4c201526431d8338f

Affected versions

Other

nightly

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.16.0

v0.17.0

v0.17.1

v0.17.2

v0.18.0

v0.19.1

v0.19.x

v0.2.0

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.21.0

v0.21.1

v0.22.0

v0.22.1

v0.23.0

v0.23.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24770.json"