如果您发现安全问题，请提交给我们。
感谢您的支持！
Any security issue please submit a vulnerability report.
Thanks for your support!
Security: 1Panel-dev/MaxKB
Security
SECURITY.md
-
UpdateStoreTool fetches caller-supplied app-store URLs without host validationGHSA-7xxm-gqxv-ph3v published
Jul 27, 2026 by liuruibinModerate -
最新MaxKB存在MCP权限绕过导致POST-Auth-rce漏洞GHSA-4pr3-9xhm-98x5 published
Jun 22, 2026 by liuruibinHigh -
Unsalted MD5 Password HashingGHSA-2m4c-mcq5-q8xq published
May 14, 2026 by liuruibinLow -
Unauthenticated SSRF via Workflow Template ImportGHSA-x9g5-j56j-4mfj published
May 14, 2026 by liuruibinLow -
Webhook Trigger Authentication Bypass - CWE-287/CWE-306GHSA-r3j3-j58q-rjpp published
May 13, 2026 by baixin513Moderate -
Broken Access Control in MaxKB OSS URL Fetch APIGHSA-2jmj-gwvg-3gp2 published
May 7, 2026 by baixin513Low -
SSRF Bypass via DNS Rebinding in MaxKB OSS URL FetchGHSA-6m4p-9wwc-4q5q published
May 7, 2026 by baixin513Low -
SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing DiscrepancyGHSA-r8hf-mwwr-hxgc published
May 6, 2026 by baixin513High -
Stored XSS via Unsanitized iframe_render Parsing in MaxKBGHSA-q2qg-43vq-f2wv published
Apr 13, 2026 by liqiang-fit2cloudModerate -
Stored XSS via Unsanitized html_rander Tags in Markdown RenderingGHSA-3rq5-pgm7-pvp4 published
Apr 13, 2026 by liqiang-fit2cloudModerate
Learn more about advisories related to 1Panel-dev/MaxKB in the GitHub Advisory Database