Back to Database
Status published
High
CVE-2025-27135
RAGFlow SQL Injection vulnerability
Vulnerability Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27135
Credits & Attribution
No credits recorded in the NVD database.
References
More from infiniflow
View All →CVE-2025-69286
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
High
8.9
CVE-2025-68700
RAGFlow Remote Code Execution Vulnerability
High
8.6
CVE-2025-48187
RAGFlow through 0.18.1 allows account takeover because it is possible...
Critical
9.1
CVE-2025-25282
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
High
8.1
CVE-2024-12880
Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow
High
8.1
Affected Vendor
infiniflow
View all reports →Affected Software
ragflow
Vulnerable Versions:
<= 0.15.1
Timeline
Official Publish:
February 25th, 2025
Last Modified:
February 25th, 2025
Added to House:
July 22nd, 2026