CVE-2025-68700

RAGFlow is a tool that helps businesses build AI search and Q&A systems using retrieval from your own content.
This bug is like leaving a “type commands” feature unlocked in a dashboard. If someone gets a normal login, they can make the server run arbitrary commands, which can expose your data or take your system offline.

This matters if you run RAGFlow (any deployment that uses RAGFlow’s Canvas CodeExec feature) and you have versions earlier than 0.23.0.
Because the problem requires a login (“low-privileged authenticated user”), it’s mainly a risk when an attacker can obtain valid access (for example, via stolen credentials, weak passwords, or an overly permissive user setup). Treat it as high risk when your RAGFlow is reachable from the internet and user accounts are exposed.

This is RED because reports indicate active exploitation in the wild by the Qilin actor, not just theoretical risk.
Even though there is no KEV entry and no public exploit code widely available, the impact is severe (server-side remote code execution), and you should upgrade immediately to remove the vulnerable behavior.

1. Confirm exposure

   • Find your installed RAGFlow version. If you can’t easily see it, check your deployment’s build/release information or the container/image tag you’re using.
   • Verify whether your RAGFlow instance has accounts that are reachable by untrusted parties (for example, if the app is internet-facing or users can sign up/log in publicly).

2. Determine whether you’re affected

   • Affected: RAGFlow versions prior to 0.23.0.
   • Not affected (per vendor fix): 0.23.0 and later.

3. Upgrade (primary fix)

   • Upgrade RAGFlow to 0.23.0 or later.
   • Use the vendor-provided fix referenced in the security advisory/commit (GHSA-8xw3-v6c2-j84j; commit 7a344a32f9f83529e12ca12f40f2657eb79fe811).
   • Plan for normal application downtime during upgrade as required by your deployment method (container restart / service restart).

4. If you cannot upgrade immediately (temporary containment)

   • Restrict access to RAGFlow so only trusted admin users can reach and use the web UI.
   • Remove public exposure if possible (limit inbound network access to trusted IPs/VPN).
   • Enforce strong password practices and reduce the chance of compromised accounts (reset exposed credentials, review user roles).

5. Validate and monitor

   • After upgrading, check logs for unusual activity around Canvas CodeExec usage (repeated attempts, errors, or unexpected commands).
   • Monitor for follow-on signs of compromise on the host (unexpected processes spawned from the RAGFlow service, unusual outbound connections, or new files).

6. KEV / timing note

   • This CVE is not listed in CISA KEV in the provided findings; however, exploitation is reported (Qilin), so you should treat it as actively dangerous regardless.

Severity and impact: High severity with full server compromise potential (remote code execution with attacker-controlled commands), affecting confidentiality, integrity, and availability.

Mechanism / weakness: The vulnerability is CWE-78 (improper neutralization of special elements used in an evaluation). In RAGFlow versions prior to 0.23.0, the frontend Canvas CodeExec functionality allows a low-privileged authenticated user to execute arbitrary system commands on the server host process. This is enabled by unsafe parsing of untrusted stdout using eval-style behavior without proper filtering or sandboxing, effectively converting untrusted strings into executable Python objects.

Attack vector / access requirements: Attackers need a valid login (low-privileged authenticated access). The findings indicate additional endpoints have access control issues or inverted permission logic, which broadens the reachable attack surface and supports chaining.

Exploitation status: KEV is not listed, and no public exploit code is on record; however, press attention indicates exploitation in the wild by the Qilin actor, and the system verdict is RED.

Fix: Version 0.23.0 includes a patch addressing this behavior. Vendor remediation references commit 7a344a32f9f83529e12ca12f40f2657eb79fe811 and GHSA-8xw3-v6c2-j84j.