RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canv…
高危 CVSS 8.5
摘要
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an ag…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
数据来源
- NVD DATABASE
原始链接
- https://github.com/infiniflow/ragflow/blob/v0.26.2/agent/component/invoke.py#L168-L172
- https://github.com/infiniflow/ragflow/commit/c4fe68eaa0bf1d6442d2cd6ac2e35bc9ccbed34f
- https://github.com/infiniflow/ragflow/commit/e16d1a0150e1ca069beb538ae3dcd03f59edc5fa
- https://github.com/infiniflow/ragflow/issues/15425
- https://github.com/infiniflow/ragflow/issues/18280
- https://github.com/infiniflow/ragflow/releases/tag/v0.26.3
- https://www.vulncheck.com/advisories/ragflow-server-side-request-forgery-via-agent-invoke-component
时间线
- nvd_ingest NVD