← Vulnerability feed

Vulnerability record · CVE-2024-12779 · published 20 March 2025

CVE-2024-12779: Infiniflow ragflow server-side request forgery (ssrf) vulnerability

Infiniflow · Ragflow

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when adding an `OPENAITTS` model, and subsequently access the `tts` REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources.

7.5 CVSS 3.1 High EPSS 0.65% · top 50.5% CWE-918 · Server-side request forgery (SSRF)
7.5CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when adding an `OPENAITTS` model, and subsequently access the `tts` REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://huntr.com/bounties/3cc748ba-2afb-4bfe-8553-10eb6d6dd4f0 Exploit
https://huntr.com/bounties/3cc748ba-2afb-4bfe-8553-10eb6d6dd4f0 Exploit

Track CVE-2024-12779 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24770Infiniflow ragflow path traversal vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a …EPSS 1.4%9.8CVE-2025-48187Infiniflow ragflow improper restriction of authentication attempts vulnerabilityRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to p…EPSS 0.54%9.8CVE-2024-12433Infiniflow ragflow deserialization of untrusted data vulnerabilityA vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey…EPSS 1.7%9.8CVE-2024-12450Infiniflow ragflow server-side request forgery (ssrf) vulnerabilityIn infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter …EPSS 1.3%8.9CVE-2025-69286Infiniflow ragflow vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm i…EPSS 0.80%8.9CVE-2025-27135Infiniflow ragflow sql injection vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL componen…EPSS 0.62%8.8CVE-2024-10131Infiniflow ragflow code injection vulnerabilityThe `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses u…EPSS 1.1%8.7CVE-2026-28797Infiniflow ragflow improper input validation vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerab…EPSS 0.56%

Source: NIST National Vulnerability Database (record CVE-2024-12779), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.