Infiniflow Ragflow Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Infiniflow Ragflow, specifically in the latest commit on the main branch. This vulnerability allows attackers to upload HTML or XML files containing arbitrary JavaScript payloads. The uploaded files are served with an 'application/xml' content type, which browsers automatically render. This could enable the execution of the injected JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and access user files and resources. The vulnerability is accessible to anyone with network access to the instance and does not require authentication.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.