CVE-2025-64703: MaxKB Information Disclosure Vulnerability

CVE-2025-64703 Overview

MaxKB is an open-source AI assistant designed for enterprise deployments. CVE-2025-64703 is an information disclosure vulnerability affecting MaxKB versions prior to 2.3.1. An authenticated user can retrieve sensitive information by executing Python code within the tool module, despite the code running inside a sandbox. The vendor addressed the issue in version 2.3.1.

The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires low privileges and network access, and impacts confidentiality without affecting integrity or availability.

Critical Impact
Authenticated attackers can bypass sandbox restrictions in the Python tool module to read sensitive information from the MaxKB host environment.

Affected Products

MaxKB versions prior to 2.3.1
Open-source enterprise AI assistant deployments using the tool module
Self-hosted MaxKB instances exposing the tool module to authenticated users

Discovery Timeline

2025-11-13 - CVE-2025-64703 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64703

Vulnerability Analysis

MaxKB provides a tool module that allows users to author and execute Python code as part of AI assistant workflows. The Python execution environment is wrapped in a sandbox intended to restrict access to sensitive host resources. In versions prior to 2.3.1, the sandbox controls are insufficient. An authenticated user can craft Python code that reads sensitive information accessible to the MaxKB process.

The issue impacts confidentiality of data on the host running MaxKB. It does not require user interaction and can be exercised over the network by any account authorized to submit tool code. Because MaxKB deployments often contain API keys, model credentials, and knowledge base content, the exposed data can facilitate follow-on attacks against connected services.

Root Cause

The root cause is inadequate isolation of the Python execution sandbox within the tool module. Available Python primitives can be used to reach information that should be inaccessible to sandboxed code. The fix in version 2.3.1 tightens the sandbox to prevent this bypass path.

Attack Vector

Exploitation requires an authenticated MaxKB account with permission to create or modify a tool. The attacker submits Python code through the tool module. When the code executes, it accesses information outside the intended sandbox boundary and returns the data through normal tool output channels. No social engineering or additional privileges are needed beyond the ability to invoke the tool.

No public proof-of-concept has been published. See the GitHub Security Advisory GHSA-qwvm-x4xh-g2qq for vendor detail.

Detection Methods for CVE-2025-64703

Indicators of Compromise

Unusual tool module activity from user accounts that do not normally author Python tools.
Tool executions that reference filesystem paths, environment variables, or process introspection modules such as os, sys, subprocess, or inspect.
Tool output containing configuration data, credentials, tokens, or file contents unrelated to the assistant's stated task.

Detection Strategies

Audit MaxKB tool definitions for Python code that reads environment variables, opens local files, or imports modules outside the expected data-processing scope.
Review MaxKB application logs for tool executions producing large or unusual output payloads.
Correlate authenticated MaxKB sessions with outbound requests to attacker-controlled endpoints that may exfiltrate tool output.

Monitoring Recommendations

Enable verbose logging on the MaxKB tool execution pipeline and forward logs to a central analytics platform.
Monitor the MaxKB host for unexpected reads of sensitive files such as /etc/passwd, .env files, and application configuration.
Track account provisioning events that grant tool authoring privileges and review them against change management records.

How to Mitigate CVE-2025-64703

Immediate Actions Required

Upgrade all MaxKB deployments to version 2.3.1 or later without delay.
Rotate credentials, API keys, and tokens that were accessible to the MaxKB process, since prior exposure cannot be ruled out.
Restrict tool authoring privileges to a minimal set of trusted administrative accounts pending upgrade verification.

Patch Information

The vendor fixed the sandbox bypass in MaxKB version 2.3.1. Refer to the GitHub Security Advisory GHSA-qwvm-x4xh-g2qq for the official fix and release notes. Upgrading to 2.3.1 or later is the primary remediation.

Workarounds

Disable the Python tool module for non-administrative users until the upgrade to 2.3.1 is complete.
Run MaxKB under a dedicated low-privilege service account with minimal filesystem and environment access.
Segment MaxKB from sensitive internal systems using network policies to limit the value of any disclosed information.

bash

# Upgrade MaxKB to a fixed release (example using Docker)
docker pull 1panel/maxkb:v2.3.1
docker stop maxkb && docker rm maxkb
docker run -d --name=maxkb \
  -p 8080:8080 \
  -v ~/.maxkb:/var/lib/postgresql/data \
  1panel/maxkb:v2.3.1