CVE-2024-12870: Stored Cross-site Scripting (XSS) in infiniflow/ragflow
First published: Thu Mar 20 2025(Updated: )
A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and gain unauthorized access to user files and resources. The vulnerability does not require authentication, making it accessible to anyone with network access to the instance.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RAGFlow |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-12870?
CVE-2024-12870 has been classified with a high severity due to its potential to allow arbitrary JavaScript execution.
How do I fix CVE-2024-12870?
To fix CVE-2024-12870, ensure that HTML/XML file uploads are properly sanitized and implement content security policies.
Who is affected by CVE-2024-12870?
CVE-2024-12870 affects users of the infiniflow/ragflow software, specifically those utilizing the latest commit on the main branch.
What kind of attack can be executed through CVE-2024-12870?
CVE-2024-12870 allows for stored cross-site scripting (XSS) attacks by enabling the upload of files containing malicious JavaScript.
When was CVE-2024-12870 disclosed?
CVE-2024-12870 was disclosed in 2024, following the discovering of the stored XSS vulnerability in the infiniflow/ragflow application.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/infiniflow
- canonical/ragflow