CVE-2026-121927 InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121927?
CVE-2026-121927 is a medium-severity vulnerability in InfiniFlow RAGFlow, published on 4 Nov 2026.
Official description
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-918
Which versions are affected by CVE-2026-121927?
How do I fix CVE-2026-121927?
No fix has been published for CVE-2026-121927 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121927 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-121927 exists.
Sources
Also known as GHSA-6c99-p4pm-w7p6.