PT-2025-37458 · Unknown · 1Panel-Dev Maxkb

Zgbsm · Published 2025-09-15 · Updated 2025-09-15 · CVE-2025-10433

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.0.2 and 2.1.0

Description A vulnerability exists in 1Panel-dev MaxKB due to improper processing of files. Specifically, the file /admin/api/workspace/default/tool/debug is susceptible to manipulation of the code argument, leading to deserialization. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Upgrade to version 2.1.1 to address the issue.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-10433

Affected Products

1Panel-Dev Maxkb

References · 10

• 🔥 https://zealous-brand-b4a.notion.site/MaxKB-2-1-0-tool-debug-RCE-2647244a828c80e7850dc6503061b88b · Exploit
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.1.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-10433 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10433 · Vendor Advisory
• https://vuldb.com/?submit.647589 · Note
• https://t.me/CVEtracker/32490 · Telegram Post
• https://t.me/cveNotify/135444 · Telegram Post
• https://vuldb.com/?id.323867 · Note
• https://vuldb.com/?ctiid.323867 · Note
• https://twitter.com/CVEnew/status/1967510254628860045 · Twitter Post