CVE-2025-48950
- Source
- https://cve.org/CVERecord?id=CVE-2025-48950
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48950.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-48950
- Aliases
-
- GHSA-p2qq-x9j2-px8v
- Published
- 2025-06-03T18:16:09.060Z
- Modified
- 2026-08-12T03:51:30.955112710Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P CVSS Calculator
- Summary
- MaxKB Python Sandbox Bypass in Function Library
- Details
-
MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as
/bin,/usr/bin, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue. - Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48950.json", "cwe_ids": [ "CWE-276" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/1Panel-dev/MaxKB/releases/tag/v1.10.8-lts
- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-p2qq-x9j2-px8v
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48950.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-48950
- https://github.com/1Panel-dev/MaxKB/commit/187e9c1e4ea1ebb6864c5bf61558c42f2fc6c005
- https://github.com/1Panel-dev/MaxKB/pull/3127
Affected packages
Git / github.com/1panel-dev/maxkb
Affected ranges
- Type
- GIT
- Repo
- https://github.com/1panel-dev/maxkb
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:maxkb:maxkb:*:*:*:*:lts:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.10.8" } ] }