CVE-2026-39424

🗓️ 14 Apr 2026 00:56:56Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

CSV injection in MaxKB chat export allows RCE via DDE for 2.7.1 and earlier; fixed in 2.8.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-39424	14 Apr 202600:56	–	attackerkb
Circl	CVE-2026-39424	14 Apr 202604:17	–	circl
CNNVD	MaxKB 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-39424 MaxKB has CSV Injection in its Application Chat Export Functionality	14 Apr 202600:56	–	cvelist
EUVD	EUVD-2026-22186	14 Apr 202600:56	–	euvd
NVD	CVE-2026-39424	14 Apr 202601:16	–	nvd
Positive Technologies	PT-2026-32578	14 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-39424	16 Apr 202619:22	–	redhatcve
Vulnrichment	CVE-2026-39424 MaxKB has CSV Injection in its Application Chat Export Functionality	14 Apr 202600:56	–	vulnrichment

NVD

Vulners

Node

maxkb maxkbRange<2.8.0-

[
  {
    "vendor": "1Panel-dev",
    "product": "MaxKB",
    "versions": [
      {
        "version": "< 2.8.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/1Panel-dev/MaxKB/commit/24cd68acae5f726eed828e2ac801827a2a70536f
github	www.github.com/1Panel-dev/MaxKB/security/advisories/GHSA-rr4r-7cj2-29vp
github	www.github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0

Parameter	Position	Path	Description	CWE
workspace_id	path	/admin/api/workspace/{workspace_id}/application/{application_id}/chat/export	Improper neutralization of formula elements in a CSV/Excel export that can lead to arbitrary code execution when the exported file is opened in spreadsheet applications.	CWE-1236
application_id	path	/admin/api/workspace/{workspace_id}/application/{application_id}/chat/export	Improper neutralization of formula elements in a CSV/Excel export that can lead to arbitrary code execution when the exported file is opened in spreadsheet applications.	CWE-1236

17 Jun 2026 10:42Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.7

CVSS 45.3

EPSS0.00368

SSVC

CWE-1236