ragflow-audit

RAGFlow three-vulnerability audit tool (CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286)

• ssti: Detect and exploit SSTI -> RCE in the StringTransform / Message components
• zipslip: Offline detection of path traversal in zip entries (Zip Slip)
• apikey: Derive API key from sharing link beta (uuid1 timestamp enumeration)

Pure Python standard library, no third-party dependencies, runs directly on Python 3.8+.

Usage

python3 ragflow-audit.py [-h] {ssti,zipslip,apikey} ...

ssti

python3 ragflow-audit.py ssti --url http://TARGET:9380 --auth "AUTH_HEADER" [--component StringTransform|Message] [--newline]

• --url: RAGFlow Web address
• --auth: The full value of the Authorization header in the login response
• --component: Target component, default StringTransform
• --newline: Use newline to bypass the payload (bypass _is_jinjia2 regex detection)

Flow: construct malicious canvas DSL -> POST /v1/canvas/set to create a canvas -> POST /v1/canvas/completion to trigger execution -> match uid= in the output to determine if RCE was successful.

zipslip

python3 ragflow-audit.py zipslip --zip evil.zip [--extract-dir /tmp/out]

Offline check of zip entries, marking three types of dangers: path traversal (..), absolute paths, and symbolic links.

apikey

python3 ragflow-audit.py apikey --beta "分享链接token" --node "攻击者user_id后12位"

Recover the uuid1 subject from the beta token in the public sharing link, enumerate time_low, and output candidate tokens. In real exploitation, call the authenticated API for each candidate token one by one (200 hit / 401 continue).

Authentication Notes

RAGFlow login credentials are in the Authorization header of the login response, not the access_token in the body. The access_token in the body is just a UUID; calling the API returns 401.

curl -i -X POST http://TARGET:9380/v1/user/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"<RSA加密后的密码>"}'

Take the value of the authorization: response header as the --auth parameter.

Note: The password for registration/login must first be RSA-encrypted (public key at /ragflow/conf/public.pem, PKCS1_v1_5, the encryption target is the plaintext after base64). Passing the plaintext password directly will cause an error.

Vulnerability Background

Disclaimer

This tool is intended only for authorized security testing and vulnerability research. Any consequences resulting from using this tool against others' systems without authorization are the sole responsibility of the user.