CVE-2025-4546 1Panel-dev MaxKB Knowledge Base Module csv injection
Attackers can inject malicious CSV content into the MaxKB knowledge base module, potentially compromising data integrity or enabling further attacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4546?
CVE-2025-4546 is a medium-severity vulnerability in 1Panel-dev MaxKB, published on 11 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.
Which versions are affected by CVE-2025-4546?
It affects 1 product.
Products include Maxkb Maxkb.
How do I fix CVE-2025-4546?
No fix has been published for CVE-2025-4546 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4546 exists.
Other vulnerabilities in 1Panel-dev MaxKB
- CVE-2025-66419 MaxKB vulnerable to privilege escalation through sandbox bypass
- CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-64511 MaxKB has SSRF in sandbox
- CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component
Sources
Also known as GHSA-7f8g-5r7m-gwx4.