RAGFlow: Injeção de Modelo do Lado do Servidor (SSTI) levando à Execução de Código Remoto (RCE) no Componente "Processamento de Texto" do Agente

The impact of this vulnerability is severe. An attacker, possessing valid authentication credentials, can leverage the SSTI flaw to inject malicious templates that execute arbitrary code on the server hosting the RAGFlow instance. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attacker could potentially gain persistent access to the system, install malware, or pivot to other systems within the network. Given RAGFlow's role in processing and augmenting data, the attacker could also manipulate the retrieval and generation processes, leading to the dissemination of false or misleading information.

Organizations utilizing RAGFlow for retrieval-augmented generation, particularly those deploying it in production environments with user-supplied templates, are at risk. This includes research institutions, content creation platforms, and any application leveraging RAGFlow's capabilities. Legacy deployments using older versions of RAGFlow are especially vulnerable.

• python: Check RAGFlow version using python -c "import ragflow; print(ragflow.version)". Versions prior to 0.24.1 are vulnerable. • linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/auth.log) for suspicious activity related to template rendering or command execution. • generic web: Inspect RAGFlow application logs for errors or unusual activity related to template processing. Look for patterns indicative of template injection attempts. • generic web: Use curl to test endpoints that utilize user-supplied templates, looking for unexpected behavior or error messages.

1. 2026-04-03Disclosure

   disclosure

1. Reservado2026-03-03
2. Publicada2026-04-03
3. Modificada2026-04-06
4. EPSS atualizado2026-04-11

The primary mitigation is to upgrade to RAGFlow version 0.24.1 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Input validation is crucial; strictly sanitize and validate all user-supplied templates before rendering them. Implement template sandboxing to restrict the available functions and resources within the template execution environment. Review and restrict permissions for authenticated users to minimize the potential impact of a successful attack. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious template injection attempts.