CVE-2026-93013

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93013
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93013.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93013
Published
2026-09-17T15:16:51Z
Modified
2026-09-18T03:48:43Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
Details

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93013.json"
}
References

Affected packages

Git / github.com/infiniflow/ragflow

Affected ranges

Type
GIT
Repo
https://github.com/infiniflow/ragflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a024bea0cd93f39e6652a42bf84dd20c55bc560b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.27.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
dev-20260622
dev-20260623
dev-20260624
dev-20260625
dev-20260626
dev-20260630
dev-20260701
dev-20260702
dev-20260703
dev-20260703-2
dev-20260706
dev-20260707
dev-20260707-2
dev-20260708
dev-20260709
dev-20260710
dev-20260713
dev-20260714
dev-20260715
dev-20260716
dev-20260716-2
dev-20260717
dev-20260720
dev-20260720-2
dev-20260721
dev-20260721-2
dev-20260722
dev-20260723
dev-20260724
dev-20260724-2
dev-20260727
dev-20260728
dev-20260729
dev-20260729-2
dev-20260730
dev-20260731
dev-20260731-2
dev-20260731-3
dev-20260801
dev-20260802
dev-20260803
dev-20260804
dev-20260804-2
dev-20260804-3
dev-20260805
dev-20260806
dev-20260806-2
dev-20260807
dev-20260807-2
dev-20260810
dev-20260811
dev-20260811-2
dev-20260812
dev-20260813
dev-20260814
dev-20260814-2
dev-20260815
dev-20260817
dev-20260818
dev-20260819
dev-20260820
dev-20260821
dev-20260824
dev-20260825
dev-20260826
dev-20260827
dev-20260831
dev-20260901
dev-20260902
dev-20260903
dev-20260904
dev-20260908
nightly
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.16.0
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.19.1
v0.19.x
v0.2.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.20.4
v0.20.5
v0.21.0
v0.21.1
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.25.5
v0.25.6
v0.26.0
v0.26.1
v0.26.2
v0.26.3
v0.26.4
v0.27.0
v0.27.1
v0.27.2
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93013.json"