CVE-2026-24770Disclosure(infiniflow / ragflow)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch infiniflow ragflow systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.

infiniflow CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/infiniflow/ragflow/commit/64c75d558e4a17a4a48953b4c201526431d8338f

Exploit / PoC references

https://github.com/infiniflow/ragflow/security/advisories/GHSA-v7cf-w7gj-pgf4

Weakness type (CWE)

CWE-22

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ragflow

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
Peaked 3d ago at 2 mentions (2026-01-27); latest day: 2
7 total mentions across 4 days

Affected systems

Vendors

infiniflow

Products

ragflow

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Disclosure

342.9%

Patch

228.6%

PoC

228.6%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-27	2	Disclosure2
2026-01-28	2	Disclosure1Patch1
2026-01-29	1	Patch1
2026-02-09	2	PoC2

Full discourse7 posts

ZoomEye@zoomeye_team242d
PoC
🚨 CVE-2026-24770: RAGFlow RCE (Zip Slip) Weaponized PoC Critical unauthenticated RCE in RAGFlow’s MinerUParser—attackers can execute arbitrary commands. 3,000+ instances are currently exposed. 🔥 PoC ready for download! Celebrate our CVE Feed launch with a $5 Special Trial to get the PoC instantly: 👉 https://www.darkeye.org/vuln/cve/CVE-2026-24770 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-24770" Dork: app="RAGFlow" 👉 ZoomEye Search Link https://www.zoomeye.ai/searchResult?q=dnVsLmN2ZT0iQ1ZFLTIwMjYtMjQ3NzAi&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260209 #Infosec #BugBounty #RAGFlow #RCE #DarkEye
Post summary
The tweet announces CVE‑2026‑24770, a critical unauthenticated RCE in RAGFlow, and offers a downloadable PoC, but does not mention active exploitation, patches, or debunking.
0302362.3K
11.9K followersView on X
CVE@CVEnew254d
Disclosure
CVE-2026-24770 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulner… https://www.cve.org/CVERecord?id=CVE-2026-24770
Post summary
CVE-2026-24770 is a Zip Slip vulnerability in RAGFlow's MinerU parser; the disclosure includes the type but no PoC, exploit code, patch, or evidence of active exploitation.
00010473
56.5K followersView on X
DarkEye@darkeye_team242d
PoC
🚨 Weaponized PoC for CVE-2026-24770 (RAGFlow RCE) Stop manual scripting. The PoC is ready. 🔥 $5 Special Trial to celebrate our CVE Feed launch! Get the PoC & Prioritized Asset List now: 👉 https://darkeye.org/vuln/cve/CVE-2026-24770 cc: @ZoomEye (3k+ targets detected 🎯) #DarkEye #RCE #PoC #Infosec
Post summary
The post announces a weaponized PoC for CVE-2026-24770 and provides a link to obtain it, but offers no exploitation code, active attack evidence, patch information, or detailed technical details.
00000270
956 followersView on X
PulsePatch.io@pulsepatchio252d
Patch
A Zip Slip RCE (CVE-2026-24770) affects RAGFlow's MinerUParser component. This can lead to remote code execution. Update to the fixed version. #RAGFlow #RCE #infosec https://www.pulsepatch.io/posts/cve-2026-24770-ragflow-zip-slip-rce
Post summary
CVE-2026-24770 is a Zip Slip RCE affecting RAGFlow's MinerUParser component; a fixed version is available and users are urged to update immediately.
0000076
1 followersView on X
PulsePatch.io@pulsepatchio253d
Patch
A critical Zip Slip RCE (CVE-2026-24770) affects Infiniflow RAGFlow's MinerUParser component. This allows remote code execution. A fix is available in version 0.23.1. #RAGFlow #RCE #infosec https://www.pulsepatch.io/posts/cve-2026-24770-ragflow-zip-slip-rce
Post summary
A critical Zip Slip RCE (CVE‑2026‑24770) in Infiniflow RAGFlow’s MinerUParser permits remote code execution, but a patch is already available in version 0.23.1.
0000074
1 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds254d
Disclosure
CVE-2026-24770 RAGFlow MinerU Parser Zip Slip Vulnerability Enables Arbitrary File Overwrite https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24770
Post summary
A Zip Slip vulnerability (CVE-2026-24770) in the RAGFlow MinerU parser enables arbitrary file overwrite.
0000081
4.0K followersView on X
0day Signal@0dayPublishing254d
Disclosure
🚨 CVE-2026-24770: RAGFlow Affected by Zip Slip Rem... Unsanitized paths in RAGFlow's MinerUParser creates trivial path traversal-to-RCE pipeline via malicious ZIP archives -... https://zerodaysignal.com/vulnerability/CVE-2026-24770 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A new vulnerability (CVE-2026-24770) is disclosed, noting unsanitized paths in MinerUParser that enable path traversal to RCE via malicious ZIP archives; no PoC, exploit tool, patch, or active exploitation is mentioned.
00000110
132 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	infiniflow	ragflow	-	-	-

Explore more

Back to dashboard infiniflow CVEs ragflow vulnerabilities

What researchers are saying

CVE-2026-24770

ZoomEye[verified]@zoomeye_teamPoC

The tweet announces CVE‑2026‑24770, a critical unauthenticated RCE in RAGFlow, and offers a downloadable PoC, but does not mention active exploitation, patches, or debunking.

DarkEye[verified]@darkeye_teamPoC

The post announces a weaponized PoC for CVE-2026-24770 and provides a link to obtain it, but offers no exploitation code, active attack evidence, patch information, or detailed technical details.

CVE@CVEnewDisclosure

CVE-2026-24770 is a Zip Slip vulnerability in RAGFlow's MinerU parser; the disclosure includes the type but no PoC, exploit code, patch, or evidence of active exploitation.

PulsePatch.io@pulsepatchioPatch

CVE-2026-24770 is a Zip Slip RCE affecting RAGFlow's MinerUParser component; a fixed version is available and users are urged to update immediately.

PulsePatch.io@pulsepatchioPatch

A critical Zip Slip RCE (CVE‑2026‑24770) in Infiniflow RAGFlow’s MinerUParser permits remote code execution, but a patch is already available in version 0.23.1.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A Zip Slip vulnerability (CVE-2026-24770) in the RAGFlow MinerU parser enables arbitrary file overwrite.

0day Signal@0dayPublishingDisclosure

A new vulnerability (CVE-2026-24770) is disclosed, noting unsanitized paths in MinerUParser that enable path traversal to RCE via malicious ZIP archives; no PoC, exploit tool, patch, or active exploitation is mentioned.