CVE-2025-64703CWE-200information-disclosure

CVE-2025-64703

Medium · published November 13, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-11-13T21:15Z
Affected products (1)
ProductVersionsFixed in
maxkb/maxkb< 2.3.12.3.1
References (1)
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-qwvm-x4xh-g2qq · [email protected]
EPSS history
Timeline
  • 13 NOV 15:52Z
    MaxKB has Information Leak in sandbox
    cvelistv5