CVE Feed

    Dashboard / CVE / CVE-2025-48950

    CVE-2025-48950

    MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue.

    Published:Jun 3, 2025
    Last Modified:Aug 6, 2025
    EPS:Jun 3, 2025
    EPSS Score:0.00059
    CVSS Score:8.8

    Affected Products

    Vendor
    Maxkb
    Product
    Maxkb

    Exploits

    https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-p2qq-x9j2-px8v

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Related CVEs

    CVE-2026-56779 (CVSS 5.3) — MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints…
    CVE-2026-39426 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39425 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39419 (CVSS 3.1) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can by…
    CVE-2026-39424 (CVSS 5.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is v…
    CVE-2026-39423 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulner…
    CVE-2026-39422 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39421 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnera…
    CVE-2026-39420 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protec…
    CVE-2026-39418 (CVSS 5) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High