CVE-2026-121928

    Dashboard / Vulnerabilities / CVE-2026-121928

    CVE-2026-121928

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: InfiniFlow RAGFlow Images API file_utils.py cross site scripting

    Details: A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.

    References: https://github.com/infiniflow/ragflow/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121928.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121928, https://vuldb.com/cve/CVE-2026-121928, https://vuldb.com/submit/1023352, https://vuldb.com/vuln/431040, https://vuldb.com/vuln/431040/cti, https://github.com/infiniflow/ragflow/commit/9ea0246f8d453a144fb4f903d163b2ba6b91ed2c, https://github.com/infiniflow/ragflow/pull/19818, https://github.com/infiniflow/ragflow/releases/tag/v0.27.3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ec9c08d809f63ba2815090182fa225899d2437d5
    Fixed -9ea0246f8d453a144fb4f903d163b2ba6b91ed2c

    Affected versions

    0.27.0
    0.27.1
    0.27.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121928 | CVE-DB