CVE Feed

    Dashboard / CVE / CVE-2025-53927

    CVE-2025-53927

    MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the `shutil.copy2` method in Python to copy the command they want to execute to the executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue.

    Published:Jul 17, 2025
    Last Modified:Aug 2, 2025
    EPS:Jul 17, 2025
    EPSS Score:0.00031
    CVSS Score:4.6

    Affected Products

    Vendor
    Maxkb
    Product
    Maxkb

    Exploits

    https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-5xhm-4j3v-87m4

    Related CVEs

    CVE-2026-56779 (CVSS 5.3) — MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints…
    CVE-2026-39426 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39425 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39419 (CVSS 3.1) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can by…
    CVE-2026-39424 (CVSS 5.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is v…
    CVE-2026-39423 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulner…
    CVE-2026-39422 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39421 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnera…
    CVE-2026-39420 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protec…
    CVE-2026-39418 (CVSS 5) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High