PT-2025-39691 · Tencent · Tencent Weknora

Jiashenghe · CVE-2025-11046 · Published 2025-09-26 · Updated 2025-09-27

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tencent WeKnora version 0.1.0

Description A security flaw exists in Tencent WeKnora version 0.1.0. The testEmbeddingModel function within the /api/v1/initialization/embedding/test file is susceptible to server-side request forgery. Manipulation of the baseUrl argument can trigger this issue, allowing for remote exploitation. The exploit has been publicly released.

Recommendations Upgrade the affected component.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-11046

Affected Products

Tencent Weknora

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11046.json · Exploit
• 🔥 https://github.com/Hebing123/cve/issues/90 · Exploit
• 🔥 https://vuldb.com/?submit.658926 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11046 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11046 · Vendor Advisory
• https://vuldb.com/?id.326083 · Note
• https://twitter.com/CVEnew/status/1971688029711466830 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971796296248787147 · Twitter Post
• https://vuldb.com/?ctiid.326083 · Note
• https://t.me/CVEtracker/33505 · Telegram Post