CVE-2025-56527

概要

参考情報

• Cinnamon/kotaemon · Product
• Cinnamon/kotaemon commit 37cdc28 · Patch
• HanTul/Kotaemon-CVE-2025-56526-56527-disclosure · Exploit
• harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73 · Exploit
• skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363 · Exploit

kotaemon のその他の脆弱性

• CVE-2025-63914中 6.5An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not che…
• CVE-2025-56526中 6.1Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.