Is CVE-2026-121927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121927 being exploited in the wild.

How severe is CVE-2026-121927?

Medium severity, with a CVSS score of 6.3, published 4 November 2026.

Which products and versions are affected?

InfiniFlow RAGFlow up to 0.27.3.

Is there a fix for CVE-2026-121927?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-121927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121927?

Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121927: InfiniFlow RAGFlow server-side request forgery in Seafile Connector

CVE-2026-121927 · Severity: medium · CVSS 6.3 · Published 2026-11-04

InfiniFlow RAGFlow is a document processing and retrieval system that integrates with Seafile cloud storage. A vulnerability in the Seafile Connector component allows remote attackers to manipulate the seafile_url parameter, causing the server to make unauthorized requests to internal or external systems. This could lead to exposure of sensitive internal services, data exfiltration, or further network compromise.

Technologies: InfiniFlow RAGFlow. Vendors: InfiniFlow.

Quick answers

Is CVE-2026-121927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121927 being exploited in the wild.
How severe is CVE-2026-121927?: Medium severity, with a CVSS score of 6.3, published 4 November 2026.
Which products and versions are affected?: InfiniFlow RAGFlow up to 0.27.3.
Is there a fix for CVE-2026-121927?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121927?: Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the _account_get function within the Seafile Connector component (common/data_source/seafile_connector.py). The vulnerability arises from improper validation of the seafile_url argument, allowing attackers to inject malicious URLs. The attack is remotely exploitable and does not require authentication or user interaction.

Affected products

InfiniFlow RAGFlow up to 0.27.3

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.