CVE-2025-53927
Last modified
CVE-2025-53927 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the `shutil.copy2` method in Python to copy the command they want to execute to the executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Maxkb | Maxkb | < 2.0.0 |
References
- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-5xhm-4j3v-87m4Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-53927?
How severe is CVE-2025-53927?
How do I fix CVE-2025-53927?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-5392The GB Forms DB plugin for WordPress is vulnerable to Remote…9.8
- CVE-2025-53922Galette is a membership management web application for non p…4.9
- CVE-2025-53923Emlog is an open source website building system. A cross-sit…6.1
- CVE-2025-53924Emlog is an open source website building system. A cross-sit…4.8
- CVE-2025-53925Emlog is an open source website building system. A cross-sit…5.4
- CVE-2025-53926Emlog is an open source website building system. A cross-sit…6.1
- CVE-2025-53928MaxKB is an open-source AI assistant for enterprise. Prior t…9.8
- CVE-2025-53929WeGIA is an open source web manager with a focus on the Port…5.4
- CVE-2025-5393The Alone – Charity Multipurpose Non-profit WordPress Theme …9.1
- CVE-2025-53930WeGIA is an open source web manager with a focus on the Port…5.4
- CVE-2025-53931WeGIA is an open source web manager with a focus on the Port…5.4
- CVE-2025-53932WeGIA is an open source web manager with a focus on the Port…6.1
Are you affected by CVE-2025-53927?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST