CVE-2025-66446
HIGHMaxKB <2.4.0 - Privilege Escalation
Title source: llmDescription
MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0.
Scores
CVSS v3
8.8
EPSS
0.0004
EPSS Percentile
12.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-362
Status
published
Affected Products (1)
maxkb/maxkb
< 2.4.0
Timeline
Published
Dec 11, 2025
Tracked Since
Feb 18, 2026