MaxKB 2.8.0 and earlier suffer a server‑side request forgery (SSRF) bypass in the OSS file service URL fetch function. The flaw arises from inconsistent DNS resolution used during validation and when the actual request is performed, allowing an attacker to craft URLs that resolve to internal network addresses. An exploit can lead to unauthorized access to internal services, potentially exposing sensitive data without granting direct code execution on the host.

The vulnerability affects the 1Panel‑dev MaxKB product, specifically all releases up to and including 2.8.0. The fix is available in 2.8.1 and newer versions.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is published, meaning the exploitation probability is currently unknown but not officially deemed negligible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a specially crafted URL to the MaxKB URL fetch endpoint; this is inferred from the described DNS resolution mismatch.