CVE-2024-12871: Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Published Mar 20, 2025

Updated

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application.

Affected Software

2 affected components

infiniflow ragflow

infiniflow ragflow=0.12.0

Event History

Mar 20, 2025

CVE Published

via MITRE·10:11 AM

Data Sourced

via MITRE·10:11 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-12871?

CVE-2024-12871 is classified as a medium severity XSS vulnerability that can lead to session hijacking.

How do I fix CVE-2024-12871?

To fix CVE-2024-12871, ensure you update to a patched version of infiniflow/ragflow that mitigates the XSS vulnerability.

What are the risks associated with CVE-2024-12871?

The risks associated with CVE-2024-12871 include potential session hijacking and unauthorized access to user data.

Which versions of infiniflow/ragflow are affected by CVE-2024-12871?

CVE-2024-12871 affects infiniflow/ragflow version 0.12.0.

Can CVE-2024-12871 be exploited remotely?

Yes, CVE-2024-12871 can be exploited remotely when a user opens a malicious PDF file uploaded to the knowledge base.