CVE-2025-11046: Tencent WeKnora test testEmbeddingModel server-side request forgery

Vulnerability summary

CVE-2025-11046 is a critical (CVSS 9.8) Server-Side Request Forgery vulnerability in tencent weknora. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 26-09-2025
   PublishedVulnerability first disclosed.
2. 29-09-2025
   Last modifiedVulnerability information updated.

Description

A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. It is advisable to upgrade the affected component. The vendor responds: "We have confirmed that the issue mentioned in the report does not exist in the latest releases".

• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.