CVE Vulnerability Catalog

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root.

Session invalidation flaw in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication does not re-validate against the database. Changing username or password does not revoke previously issued cookies, so an attacker with a valid cookie can continue accessing the admin panel.

Improper access control vulnerability in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template and trigger a panel restart, causing the xray management gRPC service, bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.

In MaxKB 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted record for a victim's published application can read victim chat records and copy victim answers via add_knowledge.

MaxKB, an open-source AI assistant for enterprise, in version 2.10.3-lts and earlier, has a vulnerability in the model parameter form route. An authenticated user with model read permission in an attacker-controlled workspace can read or overwrite the victim's model_params_form in another workspace using a known model_id, without including workspace_id in the query.

In MaxKB 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body becomes imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server.

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox.

In MaxKB 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application question-ranking endpoint when the victim's published application has ranking activity in the selected date range. An attacker who can create and publish workflow applications can place the disclosed identifier in a workflow node, trigger it, receive victim application output, and create durable application_chat records under the victim application.

In MaxKB 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list tool metadata, invoke tools/call, and create durable application_chat state.

In MaxKB 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id can retrieve the hidden tool through the tool-detail route, which does not apply per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit a workflow can place the foreign mcp_tool_id in a workflow mcp-node so debug uses the owner's MCP configuration.

In MaxKB from version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id without confirming the object belongs to that knowledge base. A normal workspace user with a known victim document or paragraph UUID can read or modify content in another user's knowledge base.

In MaxKB from version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool.

Envoy, an open source edge and service proxy, prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, has a vulnerability due to inconsistent path canonicalization. When ignore_path_parameters_in_path_matching is enabled, the router strips the semicolon suffix before matching, but the RBAC url_path matcher evaluates the raw path. A request such as /admin;x can miss a DENY rule for /admin while the router still selects the protected /admin backend.

In Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment per RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy.

In Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. The ignore_path_parameters_in_path_matching option truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment to make Envoy select an unprotected fallback while the backend resolves the protected resource.

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.

NotebookLM MCP, an MCP server and HTTP service for interacting with Google NotebookLM, versions 1.6.0 through 2.0.2, contains a path traversal vulnerability in the POST /batch-to-vault endpoint. Attacker-controlled vault_dir and slug_prefix values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process.

Joplin Server before version 3.7.7 with TRANSCRIBE_ENABLED=true has a vulnerability in the GET/POST /api/transcribe/:id routes where the decoded id is passed directly to transcription backend URLs. An authenticated user can use URL-encoded slash and parent-directory segments to escape the intended /transcribe/ prefix and proxy requests to other internal endpoints, potentially exposing administrative, health, or configuration data. This issue is fixed in version 3.7.7.

Sync-in Server before version 2.4.1 has an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.

Sync-in Server before version 2.4.0 has a vulnerability in the sync diff endpoint where it compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern (e.g. ^(a+)+b) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.