CVE-2025-27135: RAGFlow SQL Injection vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27135?
CVE-2025-27135 is classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-27135?
To mitigate CVE-2025-27135, upgrade RAGFlow to a version higher than 0.15.1 once a patched version is available.
What type of vulnerability is CVE-2025-27135?
CVE-2025-27135 is a SQL injection vulnerability affecting the ExeSQL component of RAGFlow.
Which versions of RAGFlow are affected by CVE-2025-27135?
Versions of RAGFlow up to and including 0.15.1 are affected by CVE-2025-27135.
What is the impact of CVE-2025-27135 on RAGFlow?
CVE-2025-27135 allows attackers to execute arbitrary SQL queries on the database, potentially compromising data integrity and security.