CVE-2026-93013 in RAGFlow
Summary
by MITRE • 09/17/2026
RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in RAGFlow versions up to 0.27.2 represents a critical security flaw rooted in improper input validation within specific development-oriented API endpoints. The affected functions, dev_insert_chunks_from_file and dev_insert_metadata_from_file, are designed to ingest data from external files into the system's datasets. However, these endpoints fail to adequately sanitize or validate the file_path parameter provided by the client. This lack of rigorous path normalization allows an authenticated attacker to manipulate the input string to include absolute paths rather than relative ones intended for local resource access within the application directory structure. By supplying a path such as /etc/passwd or other sensitive configuration files, the attacker bypasses the expected operational boundaries of the file ingestion mechanism.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core issue lies in the server-side processing logic which accepts the user-supplied path and attempts to read from it without verifying that the resolved absolute path remains within an allowed base directory or whitelist. In many web frameworks, if path traversal sequences like ../ are not strictly filtered or if absolute paths are accepted without containment checks, the underlying operating system resolves these references directly against the file system root. This behavior effectively grants the application process permission to read any file on the host machine that falls within the security context and permissions of the user account running the RAGFlow service.
The operational impact of this vulnerability is significant for organizations relying on RAGFlow for data processing, particularly in environments where sensitive information such as database credentials, private keys, or internal configuration files are stored in accessible locations. Although the exploitation is somewhat constrained by the requirement that the attacker must possess valid access tokens to interact with these endpoints, authenticated insider threats or compromised service accounts can leverage this flaw to exfiltrate critical data. The disclosure scope is technically limited because the application attempts to parse the read content as JSON structures before writing them to datasets. Consequently, binary files or non-JSON formatted text may not be successfully processed into the dataset viewable by other users, but raw file contents that happen to contain valid JSON fragments can still be extracted and viewed within the platform's interface, leading to partial data leakage.
This vulnerability aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to enumerate and access files on a local system through application logic rather than direct OS-level exploitation. Furthermore, because authentication is required, it also relates to aspects of privilege escalation if the service account running RAGFlow has elevated permissions beyond what is necessary for its core functionality. The presence of these development endpoints in production environments further exacerbates the risk, as they are often intended only for testing and may lack the hardened security controls present in standard user-facing APIs.
To mitigate this vulnerability, immediate remediation should involve upgrading to a version of RAGFlow where path validation has been strictly enforced or removing access to these specific development endpoints if they are not actively required for production workflows. If retention is necessary, implementing strict allow-listing of directories and rejecting any file_path parameter that resolves outside the designated upload directory is essential. Additionally, applying principle of least privilege to the service account running RAGFlow ensures that even if a path traversal occurs, the attacker cannot access sensitive system files located in restricted areas with higher permission levels. Regular security audits and static code analysis should be employed to detect similar input validation flaws across other API endpoints within the application ecosystem.