---
id: CVE-2025-68700
title: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine
summary: >-
  RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In
  versions prior to 0.23.0, a low-privileged authenticated user (normal login
  account) can execute arbitrary system commands on the server host process via
  the front…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: infiniflow
product: ragflow
affected:
  - ragflow < 0.23.0
patched:
  - ragflow 0.23.0
published: '2025-12-31'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T14:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68700'
references:
  - url: >-
      https://github.com/infiniflow/ragflow/commit/7a344a32f9f83529e12ca12f40f2657eb79fe811
    label: security-advisories@github.com
  - url: >-
      https://github.com/infiniflow/ragflow/security/advisories/GHSA-8xw3-v6c2-j84j
    label: security-advisories@github.com
  - url: >-
      https://github.com/infiniflow/ragflow/security/advisories/GHSA-8xw3-v6c2-j84j
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00702
epssPercentile: 0.51163
ingestedAt: '2026-09-23T14:25:29.784Z'
---

## Overview

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account) can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. This occurs because untrusted data (stdout) is parsed using eval() with no filtering or sandboxing. The intended design was to "automatically convert string results into Python objects," but this effectively executes attacker-controlled code. Additional endpoints lack access control or contain inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. Version 0.23.0 contains a patch for the issue.

## Affected

- `ragflow < 0.23.0`

## Remediation

Upgrade past the affected range:

- `ragflow 0.23.0`