CVE-2026-121927 | InfiniFlow RAGFlow up to 0.27.3 Seafile Connector seafile_connector.py _account_get seafile_url server-side request forgery

November 4, 2026 Yanac

A vulnerability was found in InfiniFlow RAGFlow up to 0.27.3 and classified as critical. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery.

This vulnerability is documented as CVE-2026-121927. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More