CVE-2024-12870: Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Published Mar 20, 2025

Updated

A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and gain unauthorized access to user files and resources. The vulnerability does not require authentication, making it accessible to anyone with network access to the instance.

Affected Software

1 affected component

infiniflow ragflow

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-12870?

CVE-2024-12870 has been classified with a high severity due to its potential to allow arbitrary JavaScript execution.

How do I fix CVE-2024-12870?

To fix CVE-2024-12870, ensure that HTML/XML file uploads are properly sanitized and implement content security policies.

Who is affected by CVE-2024-12870?

CVE-2024-12870 affects users of the infiniflow/ragflow software, specifically those utilizing the latest commit on the main branch.

What kind of attack can be executed through CVE-2024-12870?

CVE-2024-12870 allows for stored cross-site scripting (XSS) attacks by enabling the upload of files containing malicious JavaScript.

When was CVE-2024-12870 disclosed?

CVE-2024-12870 was disclosed in 2024, following the discovering of the stored XSS vulnerability in the infiniflow/ragflow application.