CVE-2024-12871 - CVE House
Back to Database
Status published Medium CVE-2024-12871

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Vulnerability Description

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12871

Credits & Attribution

No credits recorded in the NVD database.

References

More from infiniflow

View All →
CVE-2025-69286
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
High 8.9
CVE-2025-68700
RAGFlow Remote Code Execution Vulnerability
High 8.6
CVE-2025-48187
RAGFlow through 0.18.1 allows account takeover because it is possible...
Critical 9.1
CVE-2025-27135
RAGFlow SQL Injection vulnerability
High 8.9
CVE-2025-25282
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
High 8.1

Affected Vendor

Affected Software

infiniflow/ragflow
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact