← Vulnerability feed

Vulnerability record · CVE-2025-48187 · published 17 May 2025

CVE-2025-48187: Infiniflow ragflow improper restriction of authentication attempts vulnerability

Infiniflow · Ragflow

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

9.8 CVSS 3.1 Critical EPSS 0.54% · top 56.7% CWE-307 · Improper restriction of authentication attempts
9.8CVSS 3.1 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/infiniflow/ragflow/commits/main/ Patch
https://www.cnblogs.com/qiushuo/p/18881084 Exploit
https://www.cnblogs.com/qiushuo/p/18881084 Exploit

Track CVE-2025-48187 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24770Infiniflow ragflow path traversal vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a …EPSS 1.4%9.8CVE-2024-12433Infiniflow ragflow deserialization of untrusted data vulnerabilityA vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey…EPSS 1.7%9.8CVE-2024-12450Infiniflow ragflow server-side request forgery (ssrf) vulnerabilityIn infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter …EPSS 1.3%8.9CVE-2025-69286Infiniflow ragflow vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm i…EPSS 0.79%8.9CVE-2025-27135Infiniflow ragflow sql injection vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL componen…EPSS 0.62%8.8CVE-2024-10131Infiniflow ragflow code injection vulnerabilityThe `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses u…EPSS 1.1%8.7CVE-2026-28797Infiniflow ragflow improper input validation vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerab…EPSS 0.56%8.6CVE-2025-68700Infiniflow ragflow os command injection vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2025-48187), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.