by Kastro
Paper/Archive/CVE-2025-66419

CVE-2025-66419

1Panel-dev MaxKB — MaxKB vulnerable to privilege escalation through sandbox bypass

EPSS 0.3%CVSS 10.0
critical.is priorityof 100
35
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 23.9.239 × 204.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Affected

ProductAffectedFixed inSource
MaxKB< 2.4.0–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6crefgithub.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7refgithub.com/1Panel-dev/MaxKB/releases/tag/v2.4.0