CVE-2025-32383

Published: Apr 10, 2025Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell. This vulnerability is fixed in v1.10.4-lts.

Affected (1)

Products: Maxkb: Maxkb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Maxkb Maxkb	Before 1.10.4

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/1Panel-dev/MaxKB/commit/4ae02c8d3eb65542c88ef58c0abd94c52c949d8f

Source: security-advisories@github.com

Patch

https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-fjf6-6cvf-xr72

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.