CVE-2025-4546 MEDIUM

CVE-2025-4546: 1Panel-dev MaxKB Knowledge Base Module csv injection

Vendor 1Panel-Dev
Product MaxKB
Weakness CWE-1236
Published May 11, 2025
Last update May 12, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.

Key dates

02Disclosure timeline

May 11, 2025 CVE published
May 12, 2025 Record updated