Infiniflow - Ragflow - CRITICAL - CVE-2026-24770. The RAGFlow open-source RAG engine is vulnerable due to a flaw in the MinerU parser, specifically the '_extract_zip_no_root' method. This vulnerability arises from improper sanitization of filenames within a ZIP archive retrieved from an external source. An attacker can exploit this weakness by uploading a specially crafted ZIP file, which could lead to overwriting arbitrary files on the server and achieving remote code execution. The issue has been addressed in commit 64c75d558e4a17a4a48953b4c201526431d8338f.