← Vulnerability feed

Vulnerability record · CVE-2025-56527 · published 18 November 2025

CVE-2025-56527: Cinnamon kotaemon vulnerability

Cinnamon · Kotaemon

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

7.5 CVSS 3.1 High EPSS 0.43% · top 65.7% CWE-256 · CWE-256
7.5CVSS 3.1 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 3 tagged exploit
17 Jun 2026Last modified by NVD

Description

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Cinnamon/kotaemon Product
https://github.com/Cinnamon/kotaemon/commit/37cdc28 Patch
https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure ExploitThird Party Advisory
https://harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure- ExploitThird Party Advisory
https://skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Expos ExploitThird Party Advisory

Track CVE-2025-56527 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2025-63914Cinnamon kotaemon vulnerabilityAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the co…EPSS 0.36%6.1CVE-2025-56526Cinnamon kotaemon cross-site scripting vulnerabilityCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2025-56527), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.