CVE-2025-4546CWE-1236CWE-74

1Panel-dev MaxKB Knowledge Base Module csv injection

Medium · published May 11, 2025

CVSS v4.0
5.1
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00711 · 53.0th percentile
Weaknesses
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2025-05-11T20:00Z
EPSS history
Timeline
  • 11 MAY 20:00Z
    1Panel-dev MaxKB Knowledge Base Module csv injection
    cvelistv5