Back to Database
Status published
Critical
CVE-2025-48187
RAGFlow through 0.18.1 allows account takeover because it is possible...
Vulnerability Description
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48187
Credits & Attribution
No credits recorded in the NVD database.
References
More from infiniflow
View All →CVE-2025-69286
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
High
8.9
CVE-2025-68700
RAGFlow Remote Code Execution Vulnerability
High
8.6
CVE-2025-27135
RAGFlow SQL Injection vulnerability
High
8.9
CVE-2025-25282
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
High
8.1
CVE-2024-12880
Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow
High
8.1
Affected Vendor
infiniflow
View all reports →Affected Software
RAGFlow
Vulnerable Versions:
0
Timeline
Official Publish:
May 17th, 2025
Last Modified:
May 19th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N