CVE-2025-10433
BaseFortify
Publication date: 2025-09-15
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 1panel-dev | maxkb | 2.1.1 |
| 1panel-dev | maxkb | 2.1.0 |
| 1panel-dev | maxkb | 2.0.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10433 is a critical vulnerability in 1Panel-dev MaxKB versions up to 2.0.2 and 2.1.0, caused by unsafe deserialization of untrusted data in the /admin/api/workspace/default/tool/debug endpoint. Manipulating the 'code' argument allows an attacker to remotely execute malicious code or perform other harmful actions by exploiting the deserialization process without proper validation. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to execute arbitrary code on the affected system, potentially compromising confidentiality, integrity, and availability. This could lead to unauthorized access, data manipulation, system disruption, or full system compromise. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring requests to the endpoint /admin/api/workspace/default/tool/debug for suspicious manipulation of the 'code' argument that could lead to unsafe deserialization. Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on unusual or malformed payloads targeting this endpoint. Specific commands are not provided in the resources, but inspecting web server logs for POST or GET requests to this endpoint with unusual 'code' parameters is recommended. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the 1Panel-dev MaxKB application to version 2.1.1, which contains a fix for this vulnerability. This update addresses the unsafe deserialization issue in the tool/debug endpoint and prevents arbitrary code execution. Applying this update as soon as possible is strongly recommended to eliminate the risk. [1, 3]