Vulnerability DatabaseCVE-2025-48950
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-48950
Published:June 03, 2025
Updated:August 05, 2026
MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as "/bin,/usr/bin", etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue.
Related Resources (6)
https://nvd.nist.gov/vuln/detail/CVE-2025-48950
https://github.com/1Panel-dev/MaxKB/commit/187e9c1e4ea1ebb6864c5bf61558c42f2fc6c005
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-p2qq-x9j2-px8v
https://github.com/1Panel-dev/MaxKB/pull/3127
https://github.com/1Panel-dev/MaxKB/releases/tag/v1.10.8-lts
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48950.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.8
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
Exploit Maturity
POC
CVSS v3
Base Score:
9.9
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Incorrect Default Permissions
CWE-276
EPSS
Base Score:
0.39