PT-2025-50768 · Maxkb · Maxkb

Published 2025-12-11 · Updated 2025-12-12 · CVE-2025-66419

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.4.0

Description MaxKB, an open-source AI assistant for enterprise, contains a flaw in the tool module that allows an attacker to escape the sandbox environment and gain elevated privileges. This occurs under specific concurrent conditions.

Recommendations Update to version 2.4.0 or later.

Exploit

Fix

LPE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-66419

GHSA-F9QM-2PXQ-FX6C

Affected Products

Maxkb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66419.json · Exploit
• https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7 · Patch
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66419 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0 · Note
• https://t.me/CVEtracker/39548 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999260585129590880 · Twitter Post