CVE-2026-24770: RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineruserverurl). The extraction logic in extractzipnoroot fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24770?
CVE-2026-24770 is classified as a high severity vulnerability due to its potential for remote code execution.
What systems are affected by CVE-2026-24770?
CVE-2026-24770 affects versions of RAGFlow up to and including 0.23.1.
How do I fix CVE-2026-24770?
To fix CVE-2026-24770, you should update to the latest version of RAGFlow that addresses this vulnerability.
What is the exploit type of CVE-2026-24770?
CVE-2026-24770 involves a Zip Slip vulnerability which allows for remote code execution.
Is CVE-2026-24770 easy to exploit?
Yes, CVE-2026-24770 can be easily exploited if the affected versions of RAGFlow are in use.