MaxKB versions prior to 2.8.1 are vulnerable to an SSRF bypass in the OSS URL fetch endpoint (chat/api/oss/get_url). An attacker can send carefully crafted URLs that pass the urlparse validation but are interpreted differently by the underlying HTTP client, allowing arbitrary internal network addresses to be accessed. The flaw enables a compromise of confidentiality and integrity of internal services, as the attacker can retrieve sensitive data or further pivot within the network. The weakness is classified as CWE‑918, a Server‑Side Request Forgery.

The affected vendor is 1Panel-dev, product MaxKB, with vulnerable releases including v2.8.0 and all prior versions. The vulnerability was fixed in release 2.8.1.

The CVSS score of 6.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. However, the bypass can be triggered by anyone who can reach the chat/api/oss/get_url endpoint, so if that endpoint is exposed to untrusted users or the internet, the risk of internal compromise is significant. The attacker would need to supply a specially crafted URL; no additional user privileges are required beyond access to the vulnerable endpoint.