CVE-2025-48187

9.8 criticalEPSS 0.5%

Critical (9.8) in infiniflow ragflow. EPSS 0.5% chance of exploitation in the next 30 days.

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2025-05-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

infiniflow:ragflow

References

https://github.com/infiniflow/ragflow/commits/main/
https://www.cnblogs.com/qiushuo/p/18881084
https://www.cnblogs.com/qiushuo/p/18881084

Check your stack JSON