PT-2026-32578 · Maxkb · Maxkb

Shaohuzhang1 · CVE-2026-39424 · Published 2026-04-14 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description The chat export feature fails to properly sanitize strings starting with formula characters when an administrator exports application chat history to an Excel file (.xlsx) via the '/admin/api/workspace/{workspace id}/application/{application id}/chat/export' endpoint. This can lead to Arbitrary Code Execution (RCE) on the administrator workstation through Dynamic Data Exchange (DDE), a protocol that allows applications to share data and execute commands.

Recommendations Update to version 2.8.0.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2026-39424

GHSA-RR4R-7CJ2-29VP

Affected Products

Maxkb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39424.json · Exploit
• https://github.com/1Panel-dev/MaxKB/commit/24cd68acae5f726eed828e2ac801827a2a70536f · Patch
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-rr4r-7cj2-29vp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39424 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39424 · Vendor Advisory
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044101121841737736 · Twitter Post
• https://twitter.com/CVEnew/status/2043976149651406971 · Twitter Post