CVE-2025-48187

The application uses six-digit verification codes (only 1,000,000 possible combinations) to confirm registration, login, and password reset. Since the server does not impose any restrictions on the number of attempts (no rate limiting, IP blocks, or CAPTCHA mechanism), an attacker can automatically iterate through all possible code values. After guessing the correct code, the attacker gains full control over the registration, login, or password change process for any account associated with a given email address.

An attacker can take control of existing user accounts (including administrative ones) by resetting passwords or logging in without knowledge of the original password, as well as registering arbitrary new accounts in the system. This results in unauthorized access to application data and functions, and violates the confidentiality and integrity of the system.

Patches available from the vendor should be applied according to the references. It is recommended to track commits in the project repository (https://github.com/infiniflow/ragflow/commits/main/) to identify the version containing the fix. Until updating, it is recommended to restrict access to verification endpoints at the firewall or reverse proxy level and implement external rate limiting mechanisms.

Infiniflow RAGFlow in versions 0.18.1 and earlier