AVID-2026-R1690

Description

MaxKB has a reverse shell vulnerability in function library (CVE-2025-32383)

Details

MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell. This vulnerability is fixed in v1.10.4-lts.

Reason for inclusion in AVID: CVE-2025-32383 describes a reverse shell vulnerability in MaxKB, an open-source AI system (LLM/RAG-based) used in AI workflows. The issue resides in a software component (function library) of an AI application and represents a code-injection-style security vulnerability with network access, impacting the software supply chain used to build/deploy AI systems. The report provides CVE and advisory references, supporting classification as a security vulnerability in AI software supply chain.

References

Affected or Relevant Artifacts

Developer: 1Panel-dev
Deployer: 1Panel-dev
Artifact Details:

Type	Name
System	MaxKB

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Base Score	4.3
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🔴 High
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	🟢 Low
Integrity Impact	🟢 Low
Availability Impact	🟢 Low

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-04-10
Version: 0.3.3
AVID Entry