Advisories · Technology
1Panel-dev MaxKB.
Every CVE that names 1Panel-dev MaxKB among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)
- 1Panel-dev MaxKB
- CWE-693
- CVSS 6.3 Medium
MaxKB: Sandbox escape via unhooked fexecve
- 1Panel-dev MaxKB
- CWE-693
- CVSS 5.4 Medium
MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base
- 1Panel-dev MaxKB
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
MaxKB: Prompt-injectable agent can lead to command execution
- 1Panel-dev MaxKB
- Command injection
- Privilege escalation
- CVSS 4.3 Medium
MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation
- 1Panel-dev MaxKB
- Broken access control
- CVSS 5.4 Medium
MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
- 1Panel-dev MaxKB
- Broken access control
- CVSS 7.4 High
MaxKB: Cross-workspace model parameter form write
- 1Panel-dev MaxKB
- Broken access control
- CVSS 4.2 Medium
MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
- 1Panel-dev MaxKB
- Broken access control
- CVSS 5.0 Medium
MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
- 1Panel-dev MaxKB
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
MaxKB AWS Bedrock model credential injection leads to remote code execution
- 1Panel-dev MaxKB
- Command injection
- CVSS 5.4 Medium
MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application
- 1Panel-dev MaxKB
- Broken access control
- CVSS 5.4 Medium
MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
- 1Panel-dev MaxKB
- Authentication bypass
- CVSS 5.3 Medium
MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 8.8 High
MaxKB MCP tool import validation bypass allows post-authentication remote code execution
- 1Panel-dev MaxKB
- Command injection
- CVSS 5.3 Medium
MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
- 1Panel-dev MaxKB
- Race condition
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MaxKB: Broken Access Control in MaxKB OSS URL Fetch API
- 1Panel-dev MaxKB
- Broken access control
- CVSS 7.5 High
MaxKB: Webhook Trigger Authentication Bypass
- 1Panel-dev MaxKB
- Authentication bypass
- CVSS 6.3 Medium
MaxKB: Unauthenticated SSRF via Workflow Template Import
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
MaxKB: Unsalted MD5 Password Hashing
- 1Panel-dev MaxKB
- Weak cryptography or TLS
- CVSS 6.3 Medium
MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
MaxKB: Stored XSS via Unsanitized iframe_render Parsing
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- CVSS 3.1 Low
MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
- 1Panel-dev MaxKB
- Other injection
- Authentication bypass
- CVSS 5.3 Medium
MaxKB has CSV Injection in its Application Chat Export Functionality
- 1Panel-dev MaxKB
- Other injection
- CVSS 6.9 Medium
Stored XSS via Eval Injection in EchartsRander Component
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
MaxKB has Stored XSS via ChatHeadersMiddleware
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
- 1Panel-dev MaxKB
- Code injection
- CWE-693
- CVSS 6.3 Medium
MaxKB: Sandbox escape via LD_PRELOAD bypass
- 1Panel-dev MaxKB
- Command injection
- CWE-693
- CVSS 5.0 Medium
MaxKB: SSRF via sandbox network hook bypass
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
MaxKB: RCE via MCP stdio command injection in workflow engine
- 1Panel-dev MaxKB
- Command injection
- CWE-20
- CVSS 5.1 Medium
1Panel-dev MaxKB MdPreview chat.ts cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
- 1Panel-dev MaxKB
- Command injection
- CVSS 5.1 Medium
1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
MaxKB has a Python sandbox LD_PRELOAD bypass
- 1Panel-dev MaxKB
- Race condition
- CVSS 8.8 High
MaxKB vulnerable to privilege escalation through sandbox bypass
- 1Panel-dev MaxKB
- Race condition
- CVSS 6.3 Medium
MaxKB has Information Leak in sandbox
- 1Panel-dev MaxKB
- Information disclosure
- CVSS 7.4 High
MaxKB has SSRF in sandbox
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
1Panel-dev MaxKB debug deserialization
- 1Panel-dev MaxKB
- Insecure deserialization
- CWE-20
- CVSS 4.6 Medium
MaxKB has RCE in MCP call
- 1Panel-dev MaxKB
- Code injection
- CVSS 4.6 Medium
MaxKB sandbox bypass
- 1Panel-dev MaxKB
- Code injection
- CVSS 5.8 Medium
MaxKB Python Sandbox Bypass in Function Library
- 1Panel-dev MaxKB
- Broken access control
- CVSS 5.1 Medium
1Panel-dev MaxKB Knowledge Base Module csv injection
- 1Panel-dev MaxKB
- Other injection
- CVSS 4.3 Medium
MaxKB has a reverse shell vulnerability in function library
- 1Panel-dev MaxKB
- Code injection
- CVSS 6.8 Medium
MaxKB RCE vulnerability in function library
- 1Panel-dev MaxKB
- Command injection