{"id":"CVE-2026-121928","kind":"vulnerability","aliases":["CVE-2026-121928"],"related":[],"title":"RAGFlow: Images API lets attackers inject cross-site scripting remotely","description":"A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a cross-site scripting flaw in its Images API file handling (api/utils/file_utils.py) in versions up to 0.27.2. An attacker can run scripts in a user's browser session by sending a crafted request, and the sources say a public exploit exists.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","ragflow","self-hosted"],"not_affected_if":["version-0.27.3-or-later"],"how_to_check":"- Check the installed RAGFlow version against `0.27.2`; anything at or below it is in range.\n- Look at the RAGFlow deployment's version tag or image tag.\n- Review whether the Images API is reachable from untrusted networks.","fix":"- Upgrade RAGFlow to `0.27.3` (the sources cite patch 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c).","status":"open","published_at":"2026-11-04T19:17:32+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:20+00:00","updated_at":"2026-11-04T19:30:20+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-04T19:30:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade RAGFlow to `0.27.3` (the sources cite patch 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c).","reach":"internet","title":"RAGFlow: Images API lets attackers inject cross-site scripting remotely","impact":"medium","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a cross-site scripting flaw in its Images API file handling (api/utils/file_utils.py) in versions up to 0.27.2. An attacker can run scripts in a user's browser session by sending a crafted request, and the sources say a public exploit exists.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragflow","self-hosted","ai-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Scripts run in users' browser sessions on the RAGFlow site","analyst_note":"Confirm whether the Images API requires authentication and whether the public exploit is tied to a specific deployment setup; see the NVD entry and the linked patch and release notes.","how_to_check":"- Check the installed RAGFlow version against `0.27.2`; anything at or below it is in range.\n- Look at the RAGFlow deployment's version tag or image tag.\n- Review whether the Images API is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.27.3-or-later"],"who_is_affected":"Teams that self-host RAGFlow up to 0.27.2 and expose its web interface or Images API to users or networks beyond their own. The sources do not say whether authentication is required to reach the Images API, and the exploit is described as publicly available.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4229,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121928':14A,17A '-2026':13A,16A '0.27.2':56B,90C '0.27.3':133C '9ea0246f8d453a144fb4f903d163b2ba6b91ed2c':146C 'address':137C 'advis':152C 'affect':93C,149C 'ai':19B,22B 'ai-app':18B 'ai-tool':21B 'api':3A,48B,105C 'api/utils/file_utils.py':51B,100C 'app':20B 'attack':5A,58B,119C 'augment':35B 'avail':125C 'browser':66B 'capabl':135C 'compon':103C,150C 'craft':71B 'cross':8A,41B,110C 'cross-sit':7A,40B 'cve':12A,15A 'exist':80B 'exploit':79B,122C 'file':49B,99C 'flaw':44B 'generat':36B 'handl':50B 'host':27B 'identifi':84C,141C 'imag':2A,47B,104C 'infiniflow':86C 'initi':117C 'inject':6A 'issu':92C,139C 'lead':108C 'let':4A 'manipul':107C 'might':127C 'open':31B 'open-sourc':30B 'patch':144C 'platform':37B 'possibl':115C 'process':96C 'public':78B,124C 'ragflow':1A,24B,28B,87C 'remot':11A,120C 'request':72B 'retriev':34B 'retrieval-aug':33B 'run':60B 'say':76B 'script':10A,43B,61B,112C 'self':26B 'self-host':25B 'send':69B 'session':67B 'site':9A,42B,111C 'sourc':32B,75B 'tool':23B 'unknown':95C 'upgrad':130C,147C 'use':129C 'user':64B 'version':53B,132C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host RAGFlow up to 0.27.2 and expose its web interface or Images API to users or networks beyond their own. The sources do not say whether authentication is required to reach the Images API, and the exploit is described as publicly available.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiapps","aitooling","medium","ragflow","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121928","severity":null,"published_at":"2026-11-04T19:17:32+00:00","modified_at":"2026-11-04T19:17:32+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null}],"documents":[{"id":69745,"url":"https://github.com/infiniflow/ragflow/commit/9ea0246f8d453a144fb4f903d163b2ba6b91ed2c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49990,"url":"https://github.com/infiniflow/ragflow/releases/tag/v0.27.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}