CVE-2025-63914
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cinnamon kotaemon是Cinnamon开源的一个基于RAG的开源工具。 Cinnamon kotaemon 0.11.0版本存在安全漏洞，该漏洞源于_may_extract_zip函数未检查ZIP文件内容，可能导致资源耗尽。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-63914
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Cinnamon kotaemon 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cinnamon kotaemon是Cinnamon开源的一个基于RAG的开源工具。 Cinnamon kotaemon 0.11.0版本存在安全漏洞，该漏洞源于_may_extract_zip函数未检查ZIP文件内容，可能导致资源耗尽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2025-63914
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Public disclosure and patch for CVE-2025-63914: Zip bomb vulnerability in Cinnamon/kotaemon. | https://github.com/WxDou/CVE-2025-63914 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-63914
请登录查看更多情报信息。
Same Patch Batch · n/a · 2025-11-24 · 39 CVEs total
| CVE-2025-13584 | 3.5 LOW | Eigenfocus Description cross site scripting |
| CVE-2025-64047 | OpenRapid RapidCMS 安全漏洞 | |
| CVE-2025-60632 | free5GC 安全漏洞 | |
| CVE-2025-63953 | Magewell Ultra Encode 安全漏洞 | |
| CVE-2025-63952 | Magewell Ultra Encode 安全漏洞 | |
| CVE-2025-63958 | Millensys Vision Tools Workspace 安全漏洞 | |
| CVE-2025-63432 | Xtool AnyScan App 安全漏洞 | |
| CVE-2025-63433 | Xtool AnyScan App 安全漏洞 | |
| CVE-2025-63435 | Xtool AnyScan App 安全漏洞 | |
| CVE-2025-63434 | Xtool AnyScan App 安全漏洞 | |
| CVE-2025-60633 | free5GC 安全漏洞 | |
| CVE-2025-64048 | Yccms 安全漏洞 | |
| CVE-2025-56400 | Tuya多款产品 安全漏洞 | |
| CVE-2025-63498 | SOGo 安全漏洞 | |
| CVE-2025-54347 | Desktop Alert PingAlert 安全漏洞 | |
| CVE-2025-54341 | Desktop Alert PingAlert 安全漏洞 | |
| CVE-2025-54563 | Desktop Alert PingAlert 安全漏洞 | |
| CVE-2025-54338 | Desktop Alert PingAlert 安全漏洞 | |
| CVE-2025-63674 | Blurams Lumi A31C 安全漏洞 | |
| CVE-2024-47856 | RSA Authentication Agent 安全漏洞 |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2025-63914
No comments yet