VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-12779

CVE-2024-12779

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/add_llm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the api_base when adding an OPENAITTS model, and subsequently access the tts REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Infiniflow/Ragflow2 versions
    cpe:2.3:a:infiniflow:ragflow:0.12.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:infiniflow:ragflow:0.12.0:*:*:*:*:*:*:*
    • (no CPE)range: =0.12.0
  • infiniflow/infiniflow/ragflowv5
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.