CVE-2025-27135 RAGFlow SQL Injection vulnerability
Attackers can execute arbitrary SQL commands via the ExeSQL component in RAGFlow, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27135?
CVE-2025-27135 is a high-severity SQL injection vulnerability in infiniflow ragflow, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
Weakness: CWE-89
Which versions are affected by CVE-2025-27135?
It affects 1 product.
Products include Infiniflow Ragflow.
How do I fix CVE-2025-27135?
No fix has been published for CVE-2025-27135 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-27135 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27135 exists.
Other vulnerabilities in infiniflow ragflow
- CVE-2026-24770 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser
- CVE-2024-12433 Remote Code Execution in infiniflow/ragflow
- CVE-2025-48187 Auth bypass in RAGFlow
- CVE-2025-69286 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
- CVE-2024-10131 Remote Code Execution in infiniflow/ragflow
Sources
Also known as GHSA-3gqj-66qm-25jq.