CVE-2025-66446 in MaxKB

Riassunto

di MITRE • 12/12/2025

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsabile: GitHub M
• Prenotare: 01/12/2025
• Divulgazione: 12/12/2025
• Moderazione: accettato
• Voce: VDB-335989
• CPE: pronto
• CWE: CWE-362 (confermato)
• CVSS: 7.5 (NVD)
• EPSS: 0.00341
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-66446
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-66446
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-66446/