Security

Report a vulnerability

SECURITY.md

安全说明

如果您发现安全问题，请提交给我们。

感谢您的支持！

Security Policy

Any security issue please submit a vulnerability report.

Thanks for your support!

UpdateStoreTool fetches caller-supplied app-store URLs without host validation
GHSA-7xxm-gqxv-ph3v published Jul 27, 2026 by liuruibin
Moderate
最新MaxKB存在MCP权限绕过导致POST-Auth-rce漏洞
GHSA-4pr3-9xhm-98x5 published Jun 22, 2026 by liuruibin
High
Unsalted MD5 Password Hashing
GHSA-2m4c-mcq5-q8xq published May 14, 2026 by liuruibin
Low
Unauthenticated SSRF via Workflow Template Import
GHSA-x9g5-j56j-4mfj published May 14, 2026 by liuruibin
Low
Webhook Trigger Authentication Bypass - CWE-287/CWE-306
GHSA-r3j3-j58q-rjpp published May 13, 2026 by baixin513
Moderate
Broken Access Control in MaxKB OSS URL Fetch API
GHSA-2jmj-gwvg-3gp2 published May 7, 2026 by baixin513
Low
SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
GHSA-6m4p-9wwc-4q5q published May 7, 2026 by baixin513
Low
SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
GHSA-r8hf-mwwr-hxgc published May 6, 2026 by baixin513
High
Stored XSS via Unsanitized iframe_render Parsing in MaxKB
GHSA-q2qg-43vq-f2wv published Apr 13, 2026 by liqiang-fit2cloud
Moderate
Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
GHSA-3rq5-pgm7-pvp4 published Apr 13, 2026 by liqiang-fit2cloud
Moderate

Learn more about advisories related to 1Panel-dev/MaxKB in the GitHub Advisory Database