Skip to content
OpenAdvisories
High · 7.4 CVE-2025-64511 EUVD-2025-175302

MaxKB has SSRF in sandbox

Published Nov 13, 2025 · Updated Nov 13, 2025 · Assigned by GitHub_M

Description

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue.

Affected products

VendorProductAffectedFixed
1Panel-dev MaxKB < 2.3.1 —

References