Reverse shell vulnerability in MaxKB function library (CVE-2025-32383)
MaxKB contained a reverse shell vulnerability in its function library module that allowed privileged users to create a reverse shell through Python code execution. The vulnerability was patched in version v1.10.4-lts.
What happened
A reverse shell vulnerability exists in MaxKB's function library module that allows privileged users to create a reverse shell by running Python code.
The vulnerability affects versions up to v1.10.3-lts and was patched in v1.10.4-lts.
Reported impact
An attacker with privileged access can execute the vulnerability to obtain shell terminal access.
Index analysis
The vulnerability has a CVSS v3 score of 4.3 (Moderate), requiring high privileges and user interaction. Attack vector is network-based with low complexity.
Governance controls
The fix involved changes to the function library code and Docker container permissions, restricting shell access in the Dockerfile by removing execute permissions from /bin/sh for group access.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.