Improper Neutralization of Formula Elements in MaxKB Product by 1Panel

CVE-2026-39424

What is CVE-2026-39424?

The MaxKB application, an open-source AI assistant designed for enterprise use, contains a vulnerability in its chat export feature. In versions 2.7.1 and earlier, when administrators export chat histories to an Excel file via a specific API endpoint, inputs starting with formula characters are not properly sanitized. This oversight can allow attackers to manipulate data, leading to Arbitrary Code Execution (RCE) on the administrator's system when the file is opened in spreadsheet applications such as Microsoft Excel. This vulnerability represents a variant of the previously identified CVE-2025-4546 and has been resolved in the latest version 2.8.0.

References