CVE-2025-11046— WeKnora 代码问题漏洞

Tencent WeKnora test testEmbeddingModel server-side request forgery

A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. It is advisable to upgrade the affected component. The vendor responds: "We have confirmed that the issue mentioned in the report does not exist in the latest releases".

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

服务端请求伪造(SSRF)

WeKnora 代码问题漏洞

WeKnora是Tencent开源的一个基于LLM的框架，具有使用RAG范式进行深度文档理解、语义检索和上下文感知答案等功能。 WeKnora 0.1.0版本存在代码问题漏洞，该漏洞源于对文件/api/v1/initialization/embedding/test中参数baseUrl的错误操作，可能导致服务端请求伪造。

N/A

N/A