CVE-2026-24770

This vulnerability is like letting an attacker send a “package” that pretends to contain harmless files, but when the server unpacks it, the files are written to the wrong (more dangerous) places. Once the attacker can overwrite those files, they can cause the server to run attacker-supplied commands. For a business, that can mean stolen data, downtime, or your server being used for further attacks.

This matters to you if you use or host RAGFlow version 0.23.1 or earlier. It’s especially important if your setup allows the application to retrieve MinerU ZIP content from an external URL that an attacker can influence or control.

It’s only a risk when that external ZIP source/URL is reachable from the network path the attacker controls (precondition includes mineru_server_url being accessible by the attacker), and you’re running an affected RAGFlow version.

This is RED because attackers have been reported targeting systems in the wild (Qilin activity), and the bug enables direct remote code execution without authentication or user interaction. The attack is network-based and does not require a logged-in user—an attacker only needs reachability to your server and access to the external ZIP source behavior described in the preconditions.

1. Confirm exposure

   • Determine your RAGFlow version. If it is 0.23.1 or earlier, you are in the affected range.
   • Identify how mineru_server_url is configured. Confirm whether any attacker can make the application fetch ZIP content from an attacker-controlled server or otherwise influence the URL content.

2. Check for the vulnerable code path

   • Ensure the MinerU parsing/extraction path is used in your deployment (the vulnerability is in MinerUParser behavior that extracts ZIP archives retrieved from mineru_server_url).

3. Upgrade remediation (preferred)

   • Upgrade RAGFlow to a release that includes the patch contained in commit 64c75d558e4a17a4a48953b4c201526431d8338f.
   • Use the vendor advisory as the source of the correct patched release/build: https://github.com/infiniflow/ragflow/security/advisories/GHSA-v7cf-w7gj-pgf4
   • After upgrading, restart the service and re-check the effective configuration for mineru_server_url (it should still point only to trusted locations).

4. Temporary workaround if patching is delayed

   • Restrict network egress so the RAGFlow server can only reach trusted mineru_server_url destinations.
   • If mineru_server_url can be influenced by external users, remove that ability (lock it down so it is not attacker-controlled).
   • Add network controls (firewall / security group rules) so only your approved systems can supply MinerU ZIP files.

5. What to monitor

   • Look for signs of unexpected file writes or process launches associated with the RAGFlow host.
   • Check server logs for unusual inbound requests involving file upload/archive delivery behavior tied to this feature.
   • Validate that no unexpected outbound requests were made to untrusted URLs around the time of any suspicious activity.

6. Timing

   • No KEV listing was provided, but exploitation is linked to active actor activity per PULSE. Treat this as an urgent patch window now.

Severity is critical (CVSS 9.8) and the impact includes confidentiality, integrity, and availability. Mechanism: Zip Slip (CWE-22) in RAGFlow’s MinerUParser extraction logic fails to sanitize ZIP filenames/paths, allowing path traversal style overwrites during extraction of attacker-supplied archives. Trigger/attack vector: a network attacker sends or induces processing of a malicious ZIP so the app extracts it into unintended filesystem locations, leading to arbitrary code execution on the server. Preconditions from findings: RAGFlow version 0.23.1 or earlier; mineru_server_url external source is accessible by the attacker; reachable in default config = yes; no authentication and no user interaction required. Exploitation status: KEV is not listed, and no public exploit code was found in the provided findings, but PULSE reports actor activity (Qilin) and the traffic-light verdict is RED. Patch: vendor remediation is provided via commit 64c75d558e4a17a4a48953b4c201526431d8338f and the corresponding GHSA advisory. EPSS is provided as a prediction only (not used as the driver because active exploitation context is present). KEV meaning: CISA KEV would indicate confirmed large-scale exploitation; here it was not listed in the provided findings.