SSRF in infiniflow/ragflow (CVE-2024-12779)
Date: 2024
Affected: infiniflow/ragflow 0.12.0
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High

SSRF in ragflow 0.12.0 via POST /v1/llm/add_llm and POST /v1/conversation/tts endpoints.


Mitigations:

Architectural layers (MAESTRO):