Skip to content

CVE-2026-24770: Verified Repro With Script Download

CVE-2026-24770: RAGFlow MinerU parser Zip Slip allows arbitrary file overwrite and potential RCE via malicious ZIP archives.

Download script Open in Codespaces

CVE-2026-24770 is verified against ragflow (RAGFlow) · pip (per GitHub advisory). Affected versions: Versions prior to 0.23.1 (advisory text says 0.23.1 and possibly earlier; dbugs says prior to 0.23.1). Fixed in 0.23.1 (ticket); GitHub advisory lists patched versions: none; patch commit 64c75d558e4a17a4a48953b4c201526431d8338f. Vulnerability class: RCE. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00086.

REPRO-2026-00086 ragflow (RAGFlow) · pip (per GitHub advisory) RCE Feb 13, 2026 CVE entry ↗ .txt
Severity
CRITICAL
CVSS
9.8
Reproduced in
8m 19s
Tool calls
112
01 · Overview

What Is CVE-2026-24770?

CVE-2026-24770 is a Zip Slip path-traversal vulnerability in RAGFlow's MinerU parser, where a malicious ZIP archive can cause the parser to write files outside its intended extraction directory, enabling arbitrary file overwrite and potential remote code execution. Pruva reproduced it (reproduction REPRO-2026-00086).

02 · Severity & CVSS

CVE-2026-24770 Severity & CVSS Score

CVE-2026-24770 is rated critical severity, with a CVSS base score of 9.8 out of 10.

CRITICAL threat level
9.8 / 10 CVSS base
Weakness CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected ragflow (RAGFlow) Versions

ragflow (RAGFlow) · pip (per GitHub advisory) versions Versions prior to 0.23.1 (advisory text says 0.23.1 and possibly earlier; dbugs says prior to 0.23.1) are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2026-24770

$ pruva-verify REPRO-2026-00086
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00086/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-24770

Reproduced by Pruva's autonomous agents — 112 tool calls over 8 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 138 events · 112 tool calls · 8 min
8 minDuration
112Tool calls
21Reasoning steps
138Events
1Dead-ends
Agent activity over 8 min
Support
5
Repro
76
Variant
53
0:0008:19

Root Cause and Exploit Chain for CVE-2026-24770

Summary

RAGFlow versions prior to 0.23.1 contain a Zip Slip path traversal in the MinerU parser. The _extract_zip_no_root routine accepts ZIP member filenames verbatim and joins them with the extraction directory, allowing crafted ZIP entries to escape the intended destination and overwrite arbitrary files. By embedding an entry like test//tmp/ragflow_zip_slip_pwned, an attacker can cause the parser to write to /tmp when the ZIP is processed.

Impact

  • Component: deepdoc/parser/mineru_parser.py (MinerUParser._extract_zip_no_root).
  • Affected versions: RAGFlow < 0.23.1 (verified on v0.23.0).
  • Risk: High. Arbitrary file overwrite enables potential RCE by replacing executables, configuration, or scripts executed by the service.

Root Cause

MinerUParser._extract_zip_no_root iterates ZIP entries, strips a presumed root folder, and concatenates the remaining path with the extraction directory using os.path.join. It does not normalize or validate the member path for traversal (../), absolute paths, or alternative separators. As a result, a filename like test//tmp/ragflow_zip_slip_pwned resolves outside the extraction root and gets written directly to /tmp. The fix in commit 64c75d558e4a17a4a48953b4c201526431d8338f adds checks for absolute paths, traversal segments, symlinks, and enforces that the resolved path remains under the extraction directory.

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script checks out RAGFlow v0.23.0, crafts a ZIP with a malicious entry, and calls MinerUParser._extract_zip_no_root to extract it.
  3. Expected evidence: /tmp/ragflow_zip_slip_pwned is created with attacker-controlled content.

Evidence

  • Script output (stdout): "[+] Vulnerability reproduced: /tmp/ragflow_zip_slip_pwned created".
  • Evidence file: /tmp/ragflow_zip_slip_pwned exists after running the script.
  • Environment: Python packages installed via pip in the script (numpy, pdfplumber, Pillow, strenum, requests, beartype).

Recommendations / Next Steps

  • Apply the upstream patch from commit 64c75d558e4a17a4a48953b4c201526431d8338f (upgrade to >= 0.23.1).
  • Add path normalization and explicit checks to reject absolute paths, traversal segments, and symlink entries in ZIP archives.
  • Add regression tests that ensure ZIP entries cannot escape the extraction directory.

Additional Notes

  • The reproduction script was executed twice successfully and is idempotent.
  • The script stubs deepdoc.parser.pdf_parser to avoid unrelated dependencies while exercising the vulnerable extraction routine directly.

CVE-2026-24770 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:001:59
0:00
session startedgpt-4o · CVE-2026-24770 · b1402954
0:07
0:11
web search
0:22
0:22
extract_facts
no facts extracted
0:24
0:24
supportrepro
0:35
0:35
0:35
0:38
0:38
0:40
0:47
web search
1:03
1:07
1:11
$git clone https://github.com/infiniflow/ragflow.git /data/pruva/runs/b1402954-3aa7-4ba3-b79c-1b0a8eae7772/ragflow
4.3s✓
Cloning into '/data/pruva/runs/b1402954-3aa7-4ba3-b79c-1b0a8eae7772/ragflow'...
1:13
$git checkout v0.23.0
0.2s✓
Note: switching to 'v0.23.0'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
1:14
1:15
1:17
1:19
1:21
1:23
1:26
1:27
1:29
1:30
1:32
1:33
1:35
1:38
1:42
1:43
1:44
1:46
1:48
1:49
1:53
1:59

Artifacts and Evidence for CVE-2026-24770

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2026-24770

Upgrade ragflow (RAGFlow) · pip (per GitHub advisory) to 0.23.1 (ticket); GitHub advisory lists patched versions: none; patch commit 64c75d558e4a17a4a48953b4c201526431d8338f or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-24770 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-24770

How does the RAGFlow MinerU Zip Slip attack work?

An attacker crafts a ZIP archive containing an entry such as test//tmp/ragflow_zip_slip_pwned. When RAGFlow's MinerU parser extracts it via _extract_zip_no_root, the unsanitized path join resolves outside the intended extraction root and writes the attacker's content directly to /tmp (or any other reachable path), overwriting arbitrary files including executables or configuration used elsewhere by the service.

Which versions of RAGFlow are affected by CVE-2026-24770, and where is it fixed?

Versions prior to 0.23.1 are affected (verified on v0.23.0). It is fixed by patch commit 64c75d558e4a17a4a48953b4c201526431d8338f, which adds checks for absolute paths, traversal segments, symlinks, and enforces that the resolved path stays under the extraction directory.

How severe is CVE-2026-24770?

The root-cause analysis rates it high risk: arbitrary file overwrite that can enable remote code execution by replacing executables, configuration, or scripts the service later runs.

How can I reproduce CVE-2026-24770?

Download the verified script from this page and run it in an isolated environment against RAGFlow v0.23.0. It crafts a ZIP archive with a traversal entry like test//tmp/ragflow_zip_slip_pwned and calls MinerUParser._extract_zip_no_root to show the file being written outside the extraction directory.
11 · References

References for CVE-2026-24770

Authoritative sources for CVE-2026-24770 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.