Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-93013RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

Medium 4.3

In plain English

A medium-severity path traversal in ragflow from infiniflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.

Affected products (as reported)

Vendor	Product	Versions
infiniflow	ragflow	0 – through 0.27.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/infiniflow/ragflow/issues/19122 issue-tracking
Pull Request #19591 patch, issue-tracking
Patch Commit patch
https://github.com/infiniflow/ragflow/blob/v0.27.2/internal/handler/tenant.go#L360 technical-description
https://github.com/infiniflow/ragflow product
VulnCheck Advisory: RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal third-party-advisory