PT-2025-47562 · Unknown · Cinnamon Kotaemon

Wang Yuanrong · Published 2025-11-20 · Updated 2025-12-30 · CVE-2025-63914

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cinnamon kotaemon version 0.11.0

Description The may extract zip function in the libsktemktemindexfileui.py file does not validate the contents of uploaded ZIP files. Uploading a ZIP bomb could lead to excessive resource consumption during decompression. Extracted data from a successful attack may occupy disk space, potentially causing system unavailability. Users with file upload permissions can exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2025-63914

Affected Products

Cinnamon Kotaemon

References · 8

• 🔥 https://github.com/WxDou/CVE-2025-63914 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63914 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63914 · Vendor Advisory
• https://github.com/Cinnamon/kotaemon · Note
• https://t.me/CVEtracker/38112 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991381353082868106 · Twitter Post
• https://twitter.com/CVEnew/status/1993041330151563495 · Twitter Post
• https://t.me/cveNotify/147182 · Telegram Post