PT-2025-39691 · Tencent · Tencent Weknora

Jiashenghe · Published 2025-09-26 · Updated 2025-09-27 · CVE-2025-11046

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tencent WeKnora version 0.1.0

Description A security flaw exists in Tencent WeKnora version 0.1.0. The testEmbeddingModel function within the /api/v1/initialization/embedding/test file is susceptible to server-side request forgery. Manipulation of the baseUrl argument can trigger this issue, allowing for remote exploitation. The exploit has been publicly released.

Recommendations Upgrade the affected component.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-11046

Affected Products

Tencent Weknora

References · 9

• 🔥 https://github.com/Hebing123/cve/issues/90 · Exploit
• 🔥 https://vuldb.com/?submit.658926 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11046 · Security Note
• https://twitter.com/CVEnew/status/1971688029711466830 · Twitter Post
• https://t.me/CVEtracker/33505 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971796296248787147 · Twitter Post
• https://vuldb.com/?id.326083 · Note
• https://vuldb.com/?ctiid.326083 · Note