CVE-2025-15632 Details
Description
A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.0 is recommended to address this issue. The name of the patch is 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A stored cross-site scripting vulnerability has been identified in 1Panel-dev MaxKB versions through 2.4.2. The issue resides in the MdPreview component within the file ui/src/chat.ts. This vulnerability allows authenticated users with dataset management permissions to inject arbitrary HTML or JavaScript content, which is then executed when other users, including administrators, view the affected content.
Users are advised to upgrade to MaxKB version 2.5.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 13, 2026CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/MaxKB/ | [email protected] | Vendor |
| https://github.com/1Panel-dev/MaxKB/commit/7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8 | [email protected] | Source CodeVendor |
| https://github.com/1Panel-dev/MaxKB/pull/4578 | [email protected] | Issue TrackingVendor |
| https://github.com/1Panel-dev/MaxKB/releases/tag/v2.5.0 | [email protected] | Release NotesVendor |
| https://github.com/AnalogyC0de/public_exp/issues/28 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/782265 | [email protected] | Technical Description |
| https://vuldb.com/vuln/356967 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/356967/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Panel-dev MaxKB | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 13, 2026 | New CVE Received | [email protected] |