CVE-2025-4546: 1Panel-dev MaxKB Knowledge Base Module csv injection
Vulnerability summary
CVE-2025-4546 is a high (CVSS 8.8) vulnerability in 1panel-dev maxkb. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 11-05-2025PublishedVulnerability first disclosed.
- 12-05-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA4.7MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST5.8MediumAV:N/AC:L/Au:M/C:P/I:P/A:P
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 0.66% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPoc
Maturity: poc
Weaknesses
CWE · root cause- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-1236Improper Neutralization of Formula Elements in a CSV FileThe product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Affected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
1panel-dev1 product
- maxkb1.10.0 | 1.10.1 | 1.10.2 | 1.10.3 | 1.10.4 | 1.10.5 | 1.10.6 | 1.10.7
Maxkb1 product
- maxkb≤ 1.9.1 | ≥ 1.10.0, ≤ 1.10.7
2 vendors · 2 products