CVE-2025-56526

Medium · 6.1

CVSS

6.1

EPSS

0.4%

Published

Nov 18, 2025

CISA due date

—

The record

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

Ecosystem	Package	Introduced	Fixed