PT-2026-32584 · Maxkb · Maxkb

Liqiang-Fit2Cloud · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39425

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description Authenticated users can inject arbitrary HTML and JavaScript into the Application prologue (Opening Remarks) field by wrapping malicious payloads in tags. The backend fails to sanitize or encode HTML entities in the prologue field when applications are created or updated via the '/admin/api/workspace/{workspace id}/application' endpoint, storing the raw payload in the database. The frontend renders this content using an innerHTML-equivalent mechanism, allowing persistent DOM-based Stored Cross-Site Scripting (XSS) execution against any visitor who opens the affected chatbot interface. This can lead to session hijacking, sensitive data exposure, and unauthorized actions such as deleting workspaces or applications.

Recommendations Update to version 2.8.0.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-39425

Affected Products

Maxkb

References · 6

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-3rq5-pgm7-pvp4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39425 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEnew/status/2043976147621343319 · Twitter Post
• https://twitter.com/CVEarity/status/2044109472906522850 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043975348556063100 · Twitter Post