{"id":"CVE-2026-121927","kind":"vulnerability","aliases":["CVE-2026-121927"],"related":[],"title":"RAGFlow: Seafile connector lets attackers make the server send requests","description":"A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a server-side request forgery flaw in its Seafile connector. An attacker who controls the seafile_url setting can make the server send requests to internal or external addresses of their choosing.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ragflow","fixed":[],"affected":">= 0.27.0, <= 0.27.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-rag","ai-tooling","ragflow","seafile","self-hosted"],"not_affected_if":["newer-version","no-seafile-connector"],"how_to_check":"- Find your RAGFlow version (image tag or release file); 0.27.0 through 0.27.3 are listed as affected.\n- Check whether any dataset uses a Seafile data source, and who can add or edit data sources.\n- Also check whether a RAGFlow release newer than 0.27.3 is out and whether its seafile_connector.py validates seafile_url (for example with the common/ssrf_guard helper); I could not confirm this.","fix":null,"status":"open","published_at":"2026-11-04T18:17:42+00:00","first_seen_at":"2026-11-04T18:28:34+00:00","triaged_at":"2026-11-04T18:29:36+00:00","updated_at":"2026-11-04T18:31:14+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-04T18:29:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"RAGFlow: Seafile connector lets attackers make the server send requests","impact":"medium","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a server-side request forgery flaw in its Seafile connector. An attacker who controls the seafile_url setting can make the server send requests to internal or external addresses of their choosing.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragflow","self-hosted","seafile","ai-rag"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server reaches internal services and leaks their responses","analyst_note":"Confirm whether a fixed RAGFlow version exists and whether the Seafile connector requires credentials or is enabled by default, via the NVD entry and the upstream RAGFlow repository.","how_to_check":"- Check the RAGFlow version with the deployment's image tag or release file; versions up to `0.27.3` are listed as affected.\n- Check whether the Seafile data source connector is in use in the RAGFlow instance.","plain_action":"","needs_analyst":true,"not_affected_if":["no-seafile-connector","newer-version"],"who_is_affected":"Teams running a self-hosted RAGFlow instance with the Seafile connector, where users or admins can enter the seafile_url value. The sources do not say whether the connector is enabled by default. Instances on a newer release or without this connector can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4172,"output_tokens":561,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm whether a fixed RAGFlow version exists and whether the Seafile connector requires credentials or is enabled by default, via the NVD entry and the upstream RAGFlow repository.","search":"'-121927':13A,16A '-2026':12A,15A '0.27.3':83C 'account':91C 'address':69B 'affect':84C 'ai':19B,22B 'ai-rag':18B 'ai-tool':21B 'argument':106C 'attack':5A,52B,117C 'augment':36B 'choos':72B 'common/data_source/seafile_connector.py':96C 'compon':99C 'connector':3A,50B,101C 'contact':137C 'control':54B 'cve':11A,14A 'disclos':126C 'disclosur':141C 'earli':138C 'execut':120C 'exploit':123C 'extern':68B 'file':95C 'flaw':46B 'forgeri':45B,115C 'found':77C 'function':90C 'generat':37B 'get':92C 'host':28B 'infiniflow':79C 'intern':66B 'issu':87C 'lead':109C 'let':4A 'make':6A,60B 'manipul':103C 'may':131C 'open':32B 'open-sourc':31B 'platform':38B 'public':129C 'rag':20B 'ragflow':1A,17A,24B,29B,80C 'remot':121C 'request':10A,44B,64B,114C 'respond':145C 'retriev':35B 'retrieval-aug':34B 'seafil':2A,25B,49B,56B,100C,107C 'self':27B 'self-host':26B 'send':9A,63B 'server':8A,42B,62B,112C 'server-sid':41B,111C 'set':58B 'side':43B,113C 'sourc':33B 'tool':23B 'url':57B,108C 'use':133C 'vendor':135C 'vulner':74C 'way':148C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted RAGFlow 0.27.0 to 0.27.3 where someone can create or edit a Seafile data source and set its seafile_url; the server then sends requests to that address, which could be an internal service. The Seafile connector was added as a data source in early 2026 (PR #12945) and is configured by a user with a Seafile API token, so it looks like an authenticated feature, not one open to anonymous callers; no source says whether it is on by default. Instances that do not use the Seafile data source can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ragflow"],"ptokens":["ragflow"],"labels":["airag","aitooling","medium","ragflow","seafile","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121927","severity":null,"published_at":"2026-11-04T18:17:42+00:00","modified_at":"2026-11-04T18:17:43+00:00","first_seen_at":"2026-11-04T18:28:34+00:00","fetched_at":"2026-11-04T18:28:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121927:1690","url":null,"severity":null,"published_at":"2026-11-04T18:31:14+00:00","modified_at":"2026-11-04T18:31:14+00:00","first_seen_at":"2026-11-04T18:31:14+00:00","fetched_at":"2026-11-04T18:31:14+00:00","note":"VulDB (CNA) says the vendor did not respond; no vendor advisory, no fixed version found in the RAGFlow advisories or releases I read. A public PoC is claimed by VulDB (submit #1023351, tested at v0.27.1), but I found no link to it. Nothing verified: no primary vendor page. The login requirement is inferred from PR #12945, not stated by the CVE. NVD gives CVSS v4 PR:L, which suggests low privileges are needed."}],"documents":[{"id":69428,"url":"https://vuldb.com/vuln/431037","title":"VulDB VDB-431037: RAGFlow Seafile connector SSRF","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":69429,"url":"https://github.com/infiniflow/ragflow/pull/12945","title":"feat(connector): add Seafile as data source (PR #12945)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}