CVE Intelligence
Analysis AI-assisted

CVE-2026-24770: Infiniflow RAGFlow Zip Slip Path Traversal in MinerU Parser

CVE-2026-24770 is a critical Zip Slip (CWE-22) path traversal vulnerability in the MinerU parser of Infiniflow RAGFlow, affecting version 0.23.1 and possibly earlier. According to the record, a malicious ZIP archive can lead to arbitrary file overwrite on the server and potentially remote code execution. A patch is referenced in commit 64c75d558e4a17a4a48953b4c201526431d8338f, and CISA KEV does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24770 is a Zip Slip issue classified as CWE-22 (Path Traversal) in the MinerU parser of Infiniflow RAGFlow, an open-source Retrieval-Augmented Generation engine. The record states that the extraction routine does not sanitize file names contained in ZIP archives retrieved from an external source.

Impact

  • The record states that an attacker can overwrite arbitrary files on the server, which may lead to remote code execution.
  • The NVD/CNA score is 9.8 (CVSS 3.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), rated critical.
  • The record does not describe the exact exploitation conditions beyond the use of a malicious ZIP archive.

Affected products and versions

  • Product: Infiniflow RAGFlow, versions up to and including 0.23.1 according to the record.
  • The description says "possibly earlier versions", so the exact start of the affected range is unknown.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The GitHub advisory reference carries an "Exploit" tag, but the record does not provide details of any exploit, and this analysis does not describe one.

Remediation and mitigation

  • Review the patch in the referenced commit 64c75d558e4a17a4a48953b4c201526431d8338f and apply it to RAGFlow deployments.
  • Consult the vendor advisory GHSA-v7cf-w7gj-pgf4 for the vendor's guidance on fixed releases.
  • Restrict which external sources the MinerU parser can fetch archives from, and run RAGFlow with least privilege and restricted file system write access.

Detection guidance

  • Monitor for unexpected file creation or modification outside the expected parser working directories after document ingestion.
  • Review logs of MinerU parsing jobs for archives with unusual structure or unexpected entry paths.

Limitations of the available information

  • The record does not state a fixed version number; the patch is identified only by commit.
  • The exact set of affected versions before 0.23.1 is unknown.
  • No CVSS data beyond the CNA score is provided, and no EPSS or SSVC data is available.

Frequently asked questions

What is CVE-2026-24770?

It is a critical Zip Slip path traversal (CWE-22) in the MinerU parser of Infiniflow RAGFlow, affecting version 0.23.1 and possibly earlier, according to the record.

Is CVE-2026-24770 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.

How can I address CVE-2026-24770?

Review and apply the patch in commit 64c75d558e4a17a4a48953b4c201526431d8338f, and consult the vendor advisory GHSA-v7cf-w7gj-pgf4.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.