CVE-2026-121927: InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-level privileges in RAGFlow and must be able to manipulate the seafile_url argument used by the Seafile Connector. The attack can be executed remotely and does not require user interaction.
What is the likely impact of successful exploitation?
Successful exploitation allows server-side request forgery through the Seafile Connector. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.
Which deployments are known to be affected?
RAGFlow versions up to and including 0.27.3 are identified as affected, specifically where the Seafile Connector and its _account_get function are in use.
Is there public exploit information?
Yes. The exploit has been publicly disclosed and may be used.