CVE-2025-4546

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-4546

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4546.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-4546

Published

2025-05-11T20:00:06.708Z

Modified

2026-07-15T01:49:21.748992687Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

1Panel-dev MaxKB Knowledge Base Module csv injection

Details

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.

Database specific

{
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.10.0"
                },
                {
                    "last_affected": "1.10.0"
                },
                {
                    "introduced": "1.10.1"
                },
                {
                    "last_affected": "1.10.1"
                },
                {
                    "introduced": "1.10.2"
                },
                {
                    "last_affected": "1.10.2"
                },
                {
                    "introduced": "1.10.3"
                },
                {
                    "last_affected": "1.10.3"
                },
                {
                    "introduced": "1.10.4"
                },
                {
                    "last_affected": "1.10.4"
                },
                {
                    "introduced": "1.10.5"
                },
                {
                    "last_affected": "1.10.5"
                },
                {
                    "introduced": "1.10.6"
                },
                {
                    "last_affected": "1.10.6"
                },
                {
                    "introduced": "1.10.7"
                },
                {
                    "last_affected": "1.10.7"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-1236",
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4546.json"
}

References

Affected packages

Git / github.com/1panel-dev/maxkb

Affected ranges

Type

GIT

Repo

https://github.com/1panel-dev/maxkb

Events

Introduced

Last affected

a1d5c83f2fdd4a2564af1a943f0c169aec7b1909

Introduced

50f2c9629d2a3e075dc57c506d8ad19a50407f27

Last affected

79b2de8893c8300cd219883c1ab56ef34df40dab

Database specific

{
    "cpe": [
        "cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:maxkb:maxkb:*:*:*:*:lts:*:*:*"
    ],
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.9.1"
        },
        {
            "introduced": "1.10.0"
        },
        {
            "last_affected": "1.10.7"
        }
    ]
}

Affected versions

v0.*

v0.9.0

v0.9.1

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.10.0-lts

v1.10.1-lts

v1.10.2-lts

v1.10.3-lts

v1.10.6-lts

v1.10.7-lts

v1.2.0

v1.2.1

v1.3.0

v1.4.0

v1.5.0

v1.6.0

v1.6.1

v1.7.0

v1.9.0

v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4546.json"