infiniflow/ragflow
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
How ragflow is put together
RAGFlow is an open-source Retrieval-Augmented Generation (RAG) engine combining deep document understanding, template-based chunking, retrieval with re-ranking, and an agentic workflow engine. It is polyglot: the primary backend is a Python Flask application (api/) that bootstraps the DB, background progress workers, and a multi-platform chat-channel server; a Go module (module 'ragflow') provides additional services including a CLI/admin tooling; and a React 18 + TypeScript + Vite SPA (web/) provides the UI. Documents are ingested, parsed (deepdoc), chunked, embedded, and indexed into vector/search stores (Elasticsearch, OpenSearch, Infinity, OceanBase) with MySQL relational metadata, Redis/Valkey for caching/locks, and MinIO/S3-compatible object storage for blobs. LLM access is brokered through litellm, and agent workflows execute as canvases (agent/canvas.py) with sandboxed code execution (gVisor/e2b/UCloud/Alibaba sandboxes) and MCP tool sessions.
Languages
Frameworks
Datastores
Infrastructure
Major components
api
Flask HTTP server and service entrypoint (api/ragflow_server.py): initializes DB tables/superuser, runs background document-progress updates under a Redis distributed lock, starts the chat-channel server (Feishu/Discord/Telegram/Line/etc.), and serves the REST API.
agent
Agentic workflow engine: canvas-based orchestration (agent/canvas.py), component library (LLM, browser, invoke, loops, categorize, data operations), plugin manager (agent/plugin/), and sandboxed code execution integrations.
deepdoc
Deep document understanding: parsing and layout analysis of complex formats (PDF, DOCX, slides, Excel, scanned images) using OCR/ML models.
rag
Retrieval pipeline and benchmarking (rag/benchmark.py) over chunked/embedded knowledge bases.
common
Shared cross-cutting utilities: crypto helpers (crypto_utils.py), SSRF guard for outbound fetches (ssrf_guard.py), MCP tool-call connection lifecycle, logging, settings, and metadata filters per datastore.
admin
Admin service for user management and system monitoring (admin/server/ with auth.py/routes.py) plus a Python client CLI (admin/client, 'ragflow-cli').
web
React 18 + TypeScript single-page frontend built with Vite: dataset/chat/agent management UIs, PDF highlighter, flow editor (@xyflow/react), i18n across many locales.
memory
Agent 'Memory' feature module providing persistent memory for AI agents (per README 2025-12-26 update).
A busy week of 104 commits centered on new data-source connectors, PDF parsing fixes, and security hardening alongside continued Go/Python alignment.
3 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A busy week of 104 commits centered on new data-source connectors, PDF parsing fixes, and security hardening alongside continued Go/Python alignment.
Week of 2026-08-17
The largest week at 234 commits brought smart-reasoning agentic RAG to the Go framework, several new connectors, and a wave of parser and retrieval improvements.
Week of 2026-08-10
Sixty-two commits focused on wiki compilation improvements, a new manual-layout PDF chunker, and numerous interface and parsing refinements.
Over the past three weeks, RAGFlow's development has focused heavily on polishing the Go-based rewrite of its chat and agent pipelines to match the Python version, while also expanding data-source connectors (Azure DevOps, Azure Blob Storage, Slack, Dropbox, SharePoint) with resumable syncing. A large share of the work went into reliability fixes: PDF parsing accuracy (watermarks, cross-page tables, OCR text gaps), security hardening against path traversal and SSRF, and many small user-interface corrections. The overall arc is one of maturing a parallel Go implementation, broadening integrations, and steadily cleaning up parsing and UI rough edges.
Week by week
2026-08-24A busy week of 104 commits centered on new data-source connectors, PDF parsing fixes, and security hardening alongside continued Go/Python alignment.latest6 changes
Feature
Azure DevOps connector added
Teams can now pull documents directly from Azure DevOps into their knowledge bases.
Feature
Azure Blob Storage syncer with checkpoint resume
Syncing from Azure Blob Storage can now pick up where it left off after an interruption instead of starting over.
Fix
Security fixes for agent file uploads
Closed vulnerabilities that could let malicious URLs or file paths reach internal systems or crawl oversized responses.
Fix
PDF watermark and table-merge fixes
Tiled watermark text is stripped from extracted text, and tables spanning multiple pages merge correctly again.
Fix
Images now reach vision models in the Go chat pipeline
Uploaded image attachments are properly delivered to AI models that can see pictures when chatting through the newer Go pipeline.
Fix
Safer agent error messages
Internal terminal errors are redacted so users no longer see raw technical details when an agent fails.
2026-08-17The largest week at 234 commits brought smart-reasoning agentic RAG to the Go framework, several new connectors, and a wave of parser and retrieval improvements.6 changes
Feature
Smart-reasoning agentic RAG ported to eino ADK
The advanced multi-step reasoning capability now runs on the newer Go-based agent framework.
Feature
New data sources: Slack, Dropbox, and SharePoint
Content can be synced from Slack channels, Dropbox folders, and SharePoint sites, with Slack and others supporting resume-after-interruption.
Refactor
Faster filtered searches
Metadata filters are pushed down into the search index, making filtered document retrieval quicker.
Fix
OCR text-gap fixes in the PDF parser
Characters were being lost or duplicated during OCR; matching between recognized text and page boxes is now pinned down for accuracy.
Fix
Go chat pipeline no longer sends images to text-only models
This resolves errors like Zhipu GLM's 1210 by keeping image blocks away from models that cannot process them.
Fix
Model types inferred automatically
Models without a declared type, such as Qwen vision models, now correctly show both language and vision tags.
2026-08-10Sixty-two commits focused on wiki compilation improvements, a new manual-layout PDF chunker, and numerous interface and parsing refinements.6 changes
Feature
ManualChunker for hand-formatted PDFs
PDFs laid out manually rather than generated by software can now be split into chunks using a dedicated method.
Feature
Checkpoint-resume syncing for GitHub and RSS
GitHub repository and RSS feed syncs can resume from where they stopped instead of restarting from scratch.
Fix
Wiki compilation tracks changes incrementally
Wiki pages recompile only what changed, and disabled documents are excluded from compilation.
Fix
CID-font PDFs render correctly in preview
The web previewer now loads the right font resources so certain Asian-language and embedded-font PDFs display properly.
Fix
Lossless images sent to DeepDoc service
The document-parsing service receives PNG instead of JPEG images, preserving fine detail for better extraction.
Fix
Honest empty states and clearer labels
Search shows a truthful message when a mind map has no content, queued memory tasks show as pending rather than failed, and batch model action buttons got clearer wording.
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (4 advisories) across 691 scanned dependencies.
cryptography 46.0.7
3 advisories. Fixed in 48.0.1.
How it can be abusedAnyone sending RAGFlow a crafted encrypted message it tries to open, or a maliciously built certificate chain to validate, could exploit flaws in this library's crypto code to slowly leak secret keys or make document and API processing hang while path building explodes exponentially. This hits any deployment that accepts uploads or connections from users, since the Flask backend and ingestion pipeline run on this library's bundled OpenSSL.
- highGHSA-537c-gmf6-5ccfVulnerable OpenSSL included in cryptography wheels
- highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
- highGHSA-jwv3-5hgf-82wwpython-cryptography: Duplicate self-signed intermediates can cause exponential path-building
pyarrow 22.0.0
1 advisory. Fixed in 23.0.1.
How it can be abusedAn attacker who can upload or feed a specially crafted Arrow data file into the system could trigger a memory bug in the parsing code, potentially crashing the service or running malicious code in the context of the document processing workers. Anyone running a RAGFlow instance that ingests user-provided files is affected.
- highGHSA-rgxp-2hwp-jwggApache Arrow: Potential use-after-free when reading IPC file with pre-buffering
Code review
All protected routes under /api/v1/admin/* in the Go admin service (internal/admin/router.go protected group), guarded by AuthMiddleware in internal/handler/auth.go
Any ordinary authenticated user or API-token holder gains complete control of the admin plane: account takeover of every user, data destruction, service shutdown, and system configuration changes.
Fix: In AuthMiddleware, replace the superuser-rejection branch with a positive authorization check: resolve the caller's admin role/permission (the roles infrastructure in internal/admin/router_ee.go already exists) and abort with 403 unless the caller holds the admin role required for the routed resource.
GET /api/v1/admin/auth on the Python admin server (admin/server/routes.py auth_admin -> login_verify -> check_admin in admin/server/auth.py)
An unauthenticated attacker turns a single HTTP request into a persistent superuser account with a known default password and takes over the entire admin plane of the deployment.
Fix: Remove the user-creation block from check_admin entirely; it must only verify credentials against existing rows. Bootstrap provisioning belongs exclusively in init_default_admin at startup, and the default DEFAULT_SUPERUSER_PASSWORD should be rejected at startup rather than falling back to 'admin'.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required