The flaw is a Server‑Side Request Forgery that occurs when a user whose account is authenticated to the MaxKB system chooses a URL for the knowledge web‑document import or synchronization crawler. The crawler forwards that URL to the external library Fork.fork, which performs an HTTP GET without SSL verification and without restricting the destination host. The retrieved response body is then stored as an imported document, making internal HTTP endpoints or cloud‑metadata services visible to a low‑privileged user. The weakness allows data exfiltration but does not grant arbitrary code execution.

MaxKB version 2.10.3‑lts and all earlier releases from the 1Panel‑dev:MaxKB project are affected. No fix has been released at the time of this assessment.

With a CVSS score of 4.3, the vulnerability presents moderate risk to confidentiality for authenticated users with import privileges. No EPSS metric is available, so the probability of exploitation is unknown. The flaw is not listed in the CISA KEV catalog, and publicly available exploits are not documented. Attackers must be able to log in to the MaxKB server and submit a crafted URL; the lack of internal‑IP guarding widens the attack surface, but the requirement for authentication limits reach to existing users.