CVE-2025-27135 — RAGFlow SQL Injection vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement…
Published: 2025-02-25 · CVSS: 8.9 · CVSS 4.0
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7