CVE-2024-12871
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application.
- Affected products
- Ragflow
- Infiniflow Ragflow
- = 0.12.0
- Fix
- Available
- CVSS 3.1
- 5.4 MEDIUM
- EPSS
- 0.4% (30th percentile)
- Weakness
- CWE-79
- NVD status
- Analyzed
- Published
- 2025-03-20
CVE-2024-12871 at NVD
No indexed exploits for CVE-2024-12871 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-12871 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.