CVE-2026-45312: RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution

Synopsis

A server-side template injection (SSTI) in the Jinja2-based prompt generator of RAGFlow (rag/prompts/generator.py) lets any authenticated user run arbitrary OS commands on the server. The bug is reachable over the network by any registered user (no admin role needed) by creating a Canvas workflow that chains a DuckDuckGo component with an LLM component, triggering template evaluation on attacker-controlled input. Successful exploitation yields full remote code execution as the RAGFlow service account, with read, write, and service-disruption impact on the host. No upstream fix has been published; HarborGuard tracks the advisory and will surface a patched rebuild as soon as one is available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the RAGFlow HTTP service over the network (AV:N).

• AuthenticationRequired

  A low-privilege account is sufficient, and RAGFlow allows open self-registration, so this barrier is trivial in default deployments (PR:L).

• Victim interactionNot required

  No user has to click or approve anything; the attacker triggers the Canvas workflow themselves (UI:N).

• Attack complexityDetail

  AC:L: the exploit is reliable and condition-free once the attacker can log in and create a Canvas.

Blast Radius

• Executes arbitrary OS commands as the RAGFlow service account, giving full remote code execution on the container or host.
• Reads any data the service can access, including ingested documents, embeddings, API keys, and database credentials stored in the environment.
• Modifies or deletes RAG corpora, workflow definitions, and persisted application state.
• Crashes or hijacks the RAGFlow service, and can be used as a pivot into other services reachable from the container network.