CVE-2026-93013: path traversal enables arbitrary

CISO Take

RAGFlow through 0.27.2 has a path traversal flaw in two tenant import endpoints (dev_insert_chunks_from_file and dev_insert_metadata_from_file). An authenticated user can pass an absolute file_path and make the service read files outside the intended directory. Real-world risk is limited: the CVSS score is 4.3 (medium), CISA SSVC says TRACK, the CVE is not in KEV, no public exploit or Nuclei template exists, and the EPSS percentile is around 58%. Only files that match the expected JSON structure are disclosed, and only by being written into datasets, so the leak is narrow. It still deserves routine patching, because a stolen low-privilege token turns it into a way to pull JSON configs or credential files out of the RAG host. Upgrade to a release containing the fix (commit aa78e8d, PR #19591), and review which users hold API tokens in the meantime.

Sources:NVDEPSSATLASGitHub AdvisoryVulnCheck

What is the risk?

Low to medium. The attack is network-reachable, needs low complexity and only low privileges, but it requires a valid access token. Confidentiality impact is low because content is limited to files that parse as the expected JSON schema. There is no integrity or availability impact. There is no known exploitation, no public PoC, and the EPSS score is low (0.00511). Risk rises in multi-tenant RAGFlow deployments where untrusted users can hold tokens, or where the service runs with broad filesystem access and many JSON files (cloud credentials, app configs) sit on the host.

How does the attack unfold?

Initial Access

Attacker obtains a valid low-privilege RAGFlow access token or account.

AML.T0012

Exploitation

Attacker calls an import endpoint with an absolute file_path to bypass the missing path validation.

AML.T0049

Collection

The service reads a host JSON file that matches the expected structure and writes it into a dataset.

AML.T0037

Impact

Attacker retrieves the leaked file contents through the dataset and may use found secrets for lateral movement.

AML.T0036

Initial Access

Attacker obtains a valid low-privilege RAGFlow access token or account.

AML.T0012

Exploitation

Attacker calls an import endpoint with an absolute file_path to bypass the missing path validation.

AML.T0049

Collection

The service reads a host JSON file that matches the expected structure and writes it into a dataset.

AML.T0037

Impact

Attacker retrieves the leaked file contents through the dataset and may use found secrets for lateral movement.

AML.T0036

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade RAGFlow to a version that includes commit aa78e8d / PR #19591. 2) Until patched, block or restrict access to the tenant import endpoints (dev_insert_chunks_from_file, dev_insert_metadata_from_file) at the reverse proxy or WAF. 3) Rotate and minimize API tokens and remove unused accounts. 4) Run RAGFlow as a non-root user in a container with a read-only root filesystem and no sensitive mounts; keep secrets out of JSON files on the host. 5) Detect abuse by alerting on requests to these endpoints that contain absolute paths (e.g. leading '/' or '..') in the file_path parameter, and audit datasets for unexpected chunks that look like config or credential data.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageRAGFrameworkAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and managing AI system risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-93013?

RAGFlow through 0.27.2 has a path traversal flaw in two tenant import endpoints (dev_insert_chunks_from_file and dev_insert_metadata_from_file). An authenticated user can pass an absolute file_path and make the service read files outside the intended directory. Real-world risk is limited: the CVSS score is 4.3 (medium), CISA SSVC says TRACK, the CVE is not in KEV, no public exploit or Nuclei template exists, and the EPSS percentile is around 58%. Only files that match the expected JSON structure are disclosed, and only by being written into datasets, so the leak is narrow. It still deserves routine patching, because a stolen low-privilege token turns it into a way to pull JSON configs or credential files out of the RAG host. Upgrade to a release containing the fix (commit aa78e8d, PR #19591), and review which users hold API tokens in the meantime.

Is CVE-2026-93013 actively exploited?

No confirmed active exploitation of CVE-2026-93013 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93013?

1) Upgrade RAGFlow to a version that includes commit aa78e8d / PR #19591. 2) Until patched, block or restrict access to the tenant import endpoints (dev_insert_chunks_from_file, dev_insert_metadata_from_file) at the reverse proxy or WAF. 3) Rotate and minimize API tokens and remove unused accounts. 4) Run RAGFlow as a non-root user in a container with a read-only root filesystem and no sensitive mounts; keep secrets out of JSON files on the host. 5) Detect abuse by alerting on requests to these endpoints that contain absolute paths (e.g. leading '/' or '..') in the file_path parameter, and audit datasets for unexpected chunks that look like config or credential data.

What systems are affected by CVE-2026-93013?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, Knowledge base ingestion services, Multi-tenant AI platforms.

What is the CVSS score for CVE-2026-93013?

CVE-2026-93013 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesKnowledge base ingestion servicesMulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.

Exploitation Scenario

An attacker obtains a low-privilege RAGFlow token through a phished user, a leaked API key, or a self-registered account. They call the dev_insert_chunks_from_file endpoint with file_path set to an absolute path of a JSON file on the host, such as a cloud credentials file or an application config. The service reads the file and writes its contents into a dataset the attacker controls. The attacker then queries or exports that dataset to retrieve the secrets, and uses them to move laterally into cloud or LLM provider accounts.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.