1Panel Dev Maxkb vulnerabilities, page 3
47 vulnerabilities
Known vulnerabilities in 1Panel Dev Maxkb, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2025-104331panel-dev · maxkb1Panel-dev MaxKB debug deserializationA vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/debug. Executing manipulation of the argument code can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.1 is capable of addressing this issue. It is suggested to upgrade the affected component.CVSS6.5MediumEPSS0.32%RoutineCVE-2025-539281panel-dev · maxkb +1 moreMaxKB has RCE in MCP callMaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue.CVSS9.8CriticalEPSS0.50%RoutineCVE-2025-539271panel-dev · maxkb +1 moreMaxKB sandbox bypassMaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the `shutil.copy2` method in Python to copy the command they want to execute to the executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue.CVSS6.3MediumEPSS0.27%RoutineCVE-2025-489501panel-dev · maxkb +1 moreMaxKB Python Sandbox Bypass in Function LibraryMaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue.CVSS8.8HighEPSS0.48%RoutineCVE-2025-45461panel-dev · maxkb +1 more1Panel-dev MaxKB Knowledge Base Module csv injectionA vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.CVSS8.8HighEPSS0.71%RoutineCVE-2025-323831panel-dev · maxkb +1 moreMaxKB has a reverse shell vulnerability in function libraryMaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged users to create a reverse shell. This vulnerability is fixed in v1.10.4-lts.CVSS7.2HighEPSS0.29%RoutineCVE-2024-561371panel-dev · maxkb +1 moreMaxKB RCE vulnerability in function libraryMaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.CVSS7.2HighEPSS0.81%