CVE-2025-63914: Medium severity Cinnamon kotaemon vulnerability
An issue was discovered in Cinnamon kotaemon 0.11.0. The mayextractzip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63914?
CVE-2025-63914 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-63914?
To mitigate CVE-2025-63914, ensure to validate and sanitize the contents of uploaded ZIP files before extraction.
What specific component is affected by CVE-2025-63914?
CVE-2025-63914 specifically affects the _may_extract_zip function in the Cinnamon kotaemon software.
Can CVE-2025-63914 lead to arbitrary code execution?
Yes, CVE-2025-63914 can potentially allow an attacker to execute arbitrary code through crafted ZIP file uploads.
Is there a known fix version for CVE-2025-63914?
As of now, there is no known fixed version publicly available for CVE-2025-63914 in Cinnamon kotaemon.