Vulnerability Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Infiniflow | Ragflow | <= 0.15.1 |
Related Weaknesses (CWE)
References
- https://github.com/infiniflow/ragflow/blob/v0.15.1/agent/component/exesql.pyProduct
- https://github.com/infiniflow/ragflow/security/advisories/GHSA-3gqj-66qm-25jqVendor Advisory
- https://swizzky.notion.site/ragflow-exesql-150ca6df7c03806989cefde915cf8e42?pvs=Exploit
- https://swizzky.notion.site/ragflow-exesql-150ca6df7c03806989cefde915cf8e42Exploit
FAQ
What is CVE-2025-27135?
CVE-2025-27135 is a vulnerability with a CVSS score of 9.8 (CRITICAL). RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sen...
How severe is CVE-2025-27135?
CVE-2025-27135 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-27135?
Check the references section above for vendor advisories and patch information. Affected products include: Infiniflow Ragflow.