---
id: "CVE-2026-121928"
kind: "vulnerability"
aliases: ["CVE-2026-121928"]
title: "RAGFlow: Images API lets attackers inject cross-site scripting remotely"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-apps", "ai-tooling", "ragflow", "self-hosted"]
not_affected_if: ["version-0.27.3-or-later"]
published_at: "2026-11-04T19:17:32+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:30:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121928", "first_seen_at": "2026-11-04T19:28:48+00:00"}]
---

# RAGFlow: Images API lets attackers inject cross-site scripting remotely

RAGFlow, an open-source retrieval-augmented generation platform, has a cross-site scripting flaw in its Images API file handling (api/utils/file_utils.py) in versions up to 0.27.2. An attacker can run scripts in a user's browser session by sending a crafted request, and the sources say a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed RAGFlow version against `0.27.2`; anything at or below it is in range.
- Look at the RAGFlow deployment's version tag or image tag.
- Review whether the Images API is reachable from untrusted networks.

## Fix

- Upgrade RAGFlow to `0.27.3` (the sources cite patch 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c).

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121928

## Documents

- [fix] Patch: github.com https://github.com/infiniflow/ragflow/commit/9ea0246f8d453a144fb4f903d163b2ba6b91ed2c
- [fix] Release notes: github.com https://github.com/infiniflow/ragflow/releases/tag/v0.27.3

## From the sources

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_