CVE-2025-27135 – CVE-2025-27135 is a critical SQL injection vuln... (How to Fix)

Q: What is the severity of CVE-2025-27135?

CVE-2025-27135 has a CVSS score of 9.8 (CRITICAL). CVE-2025-27135 is a critical SQL injection vulnerability in RAGFlow's ExeSQL component that allows attackers to execute arbitrary SQL commands on the database. This affects all deployments running RAGFlow version 0.15.1 or earlier. The vulnerability occurs because user input is directly passed to database queries without proper sanitization.

📋 TL;DR

CVE-2025-27135 is a critical SQL injection vulnerability in RAGFlow's ExeSQL component that allows attackers to execute arbitrary SQL commands on the database. This affects all deployments running RAGFlow version 0.15.1 or earlier. The vulnerability occurs because user input is directly passed to database queries without proper sanitization.

💻 Affected Systems

Products:

RAGFlow

Versions: 0.15.1 and prior

Operating Systems: All operating systems running RAGFlow

Default Config Vulnerable: ⚠️ Yes

Notes: All deployments using the vulnerable ExeSQL component are affected regardless of configuration.

📦 What is this software?

Ragflow by Infiniflow

View all CVEs affecting Ragflow →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including data theft, data destruction, privilege escalation, and potential remote code execution if database functions allow it.

🟠

Likely Case

Unauthorized data access, data manipulation, and potential extraction of sensitive information from the database.

🟢

If Mitigated

Limited impact with proper input validation and database permission restrictions, though SQL injection attempts may still cause service disruption.

🌐 Internet-Facing: HIGH - RAGFlow deployments exposed to the internet are directly vulnerable to automated SQL injection attacks.

🏢 Internal Only: HIGH - Even internal deployments are vulnerable to insider threats or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection vulnerabilities are well-understood with many automated tools available. The advisory includes technical details that facilitate exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: https://github.com/infiniflow/ragflow/security/advisories/GHSA-3gqj-66qm-25jq

Restart Required: Yes

Instructions:

1. Monitor the RAGFlow GitHub repository for security updates. 2. When a patched version is released, update to the latest version. 3. Restart the RAGFlow service after updating.

🔧 Temporary Workarounds

Disable ExeSQL Component

all

Temporarily disable or remove the vulnerable ExeSQL component from RAGFlow deployments.

# Remove or rename the vulnerable file
mv /path/to/ragflow/agent/component/exesql.py /path/to/ragflow/agent/component/exesql.py.disabled

Implement WAF Rules

all

Deploy web application firewall rules to block SQL injection patterns targeting the ExeSQL endpoint.

# Example ModSecurity rule
SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'"

🧯 If You Can't Patch

Implement strict input validation and parameterized queries for all SQL operations
Apply database-level controls: use least privilege accounts, enable query logging, and implement network segmentation

🔍 How to Verify

Check if Vulnerable:

Check if RAGFlow version is 0.15.1 or earlier and if the ExeSQL component exists in the installation.

Check Version:

Check RAGFlow documentation or configuration files for version information, or run: python -c "import ragflow; print(ragflow.__version__)" if available

Verify Fix Applied:

Verify that parameterized queries are implemented and user input is properly sanitized before database execution.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts via ExeSQL endpoint
SQL syntax errors in application logs

Network Indicators:

HTTP requests containing SQL keywords (SELECT, UNION, DROP, etc.) to ExeSQL endpoints
Unusual database connection patterns

SIEM Query:

source="*ragflow*" AND ("exesql" OR "sql injection" OR "union select" OR "1=1")

📊 Metadata

CVE ID: CVE-2025-27135

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

EPSS Score: 0.32% exploit probability (54.8th percentile)

Published: February 25, 2025

Last Updated: April 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-27135, you might also want to check these: