1Panel-dev MaxKB Deserialization Vulnerability in Debug Tool Endpoint
Vulnerability
A deserialization vulnerability has been identified in 1Panel-dev MaxKB versions through 2.0.2 and 2.1.0. The issue arises in the file '/admin/api/workspace/default/tool/debug', where manipulation of the 'code' argument can lead to unauthorized data deserialization. This vulnerability can be exploited remotely, and a public exploit is available.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where MaxKB is running.
Remediation
Users are advised to upgrade to MaxKB version 2.1.1, which addresses this vulnerability.
Added: Sep 15, 2025, 8:18 AM
Updated: Sep 15, 2025, 8:18 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
6.6remediation
7.7relevance
0.5threat
6.4urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.