High severity · published May 11, 2025
CVE-2025-4546
1Panel-dev MaxKB Knowledge Base Module csv injection
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MaxKB · 1Panel-dev
1.10.0; 1.10.1; 1.10.2; 1.10.3; 1.10.4; 1.10.5; +2 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4546
Exploit
https://github.com/yaowenxiao721/Poc/blob/main/MaxKB/MaxKB-poc1.md
Permissions Required
https://vuldb.com/?ctiid.308293
Third Party Advisory
https://vuldb.com/?id.308293
Third Party Advisory
https://vuldb.com/?submit.566517
More from MaxKB
10.0
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution
10.0
CVE-2025-66419
MaxKB vulnerable to privilege escalation through sandbox bypass
9.8
CVE-2025-53928
MaxKB has RCE in MCP call
9.1
CVE-2026-79916
MaxKB AWS Bedrock model credential injection leads to remote code execution
8.8
CVE-2026-54149
MaxKB MCP tool import validation bypass allows post-authentication remote code execution