← Vulnerability feed

Vulnerability record · CVE-2025-63914 · published 24 November 2025

CVE-2025-63914: Cinnamon kotaemon vulnerability

Cinnamon · Kotaemon

An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack.

6.5 CVSS 3.1 Medium EPSS 0.36% · top 73.1% CWE-409 · CWE-409
6.5CVSS 3.1 base score
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Cinnamon/kotaemon Product
https://github.com/WxDou/CVE-2025-63914 ExploitThird Party Advisory

Track CVE-2025-63914 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2025-56527Cinnamon kotaemon vulnerabilityPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.EPSS 0.43%6.1CVE-2025-56526Cinnamon kotaemon cross-site scripting vulnerabilityCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2025-63914), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.