CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1879 vulnerabilities reference this CWE, most recent first.
GHSA-M4PJ-3G4R-X6M8
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-07-01 00:01An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It allows XXE attacks for read/write access to arbitrary files.
{
"affected": [],
"aliases": [
"CVE-2020-25257"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-11T03:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It allows XXE attacks for read/write access to arbitrary files.",
"id": "GHSA-m4pj-3g4r-x6m8",
"modified": "2022-07-01T00:01:13Z",
"published": "2022-05-24T17:28:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25257"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Sep/23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M53P-F25Q-Q6FG
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-12-21 16:42Robot Framework Plugin 2.0.0 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for the 'Publish Robot Framework' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.
Robot Framework Plugin 2.0.1 disables external entity resolution for its XML parser.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:robot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2092"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-21T16:42:17Z",
"nvd_published_at": "2020-01-15T16:15:00Z",
"severity": "HIGH"
},
"details": "Robot Framework Plugin 2.0.0 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows a user able to control the input files for the \u0027Publish Robot Framework\u0027 post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.\n\nRobot Framework Plugin 2.0.1 disables external entity resolution for its XML parser.",
"id": "GHSA-m53p-f25q-q6fg",
"modified": "2022-12-21T16:42:17Z",
"published": "2022-05-24T17:06:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2092"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/robot-plugin/commit/a06626f516e63813db570ff9f3e9b1f76012df59"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/robot-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "XXE vulnerability in Jenkins Robot Framework Plugin"
}
GHSA-M56X-7JGW-3HFR
Vulnerability from github – Published: 2023-02-03 21:30 – Updated: 2023-02-13 15:30XML External Entity (XXE) vulnerability in Talend Remote Engine Gen 2 before R2022-09.
{
"affected": [],
"aliases": [
"CVE-2022-45588"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-03T21:15:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity (XXE) vulnerability in Talend Remote Engine Gen 2 before R2022-09.",
"id": "GHSA-m56x-7jgw-3hfr",
"modified": "2023-02-13T15:30:26Z",
"published": "2023-02-03T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45588"
},
{
"type": "WEB",
"url": "https://www.talend.com/security/incident-response/#CVE-2022-45588"
},
{
"type": "WEB",
"url": "http://talend.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M68W-G32J-MW5X
Vulnerability from github – Published: 2026-07-30 15:31 – Updated: 2026-07-30 15:31CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.
{
"affected": [],
"aliases": [
"CVE-2026-54366"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T13:16:51Z",
"severity": "HIGH"
},
"details": "CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.",
"id": "GHSA-m68w-g32j-mw5x",
"modified": "2026-07-30T15:31:50Z",
"published": "2026-07-30T15:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54366"
},
{
"type": "WEB",
"url": "https://www.centrestack.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/centrestack-xxe-via-sharepoint-storage-configuration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M739-F9CM-66X2
Vulnerability from github – Published: 2026-07-03 09:31 – Updated: 2026-07-08 18:31Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).
This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.
Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-47898"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T08:16:24Z",
"severity": "MODERATE"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).\n\nThis issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.\n\nUsers are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.",
"id": "GHSA-m739-f9cm-66x2",
"modified": "2026-07-08T18:31:32Z",
"published": "2026-07-03T09:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47898"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7yn9k6sbbsk18yco5y2hszpcf8dst489"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/03/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M745-JCVJ-8CX6
Vulnerability from github – Published: 2023-10-18 12:30 – Updated: 2025-10-22 00:32Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
{
"affected": [],
"aliases": [
"CVE-2023-45727"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-18T10:15:08Z",
"severity": "HIGH"
},
"details": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.",
"id": "GHSA-m745-jcvj-8cx6",
"modified": "2025-10-22T00:32:51Z",
"published": "2023-10-18T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45727"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN95981460"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45727"
},
{
"type": "WEB",
"url": "https://www.proself.jp/information/153"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M7JW-5WWC-GXWH
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2022-10-14 12:00An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator (LXCI) for VMWare vCenter prior to version 6.1.0 that could allow information disclosure.
{
"affected": [],
"aliases": [
"CVE-2019-6179"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-03T19:15:00Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator (LXCI) for VMWare vCenter prior to version 6.1.0 that could allow information disclosure.",
"id": "GHSA-m7jw-5wwc-gxwh",
"modified": "2022-10-14T12:00:18Z",
"published": "2022-05-24T16:55:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6179"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/solutions/LEN-27805"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M7M4-4VM8-55WG
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2024-10-21 20:11PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyamf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-8549"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-31T21:54:25Z",
"nvd_published_at": "2020-01-15T15:15:00Z",
"severity": "HIGH"
},
"details": "PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.",
"id": "GHSA-m7m4-4vm8-55wg",
"modified": "2024-10-21T20:11:40Z",
"published": "2022-05-24T17:06:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8549"
},
{
"type": "WEB",
"url": "https://github.com/hydralabs/pyamf/pull/58"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m7m4-4vm8-55wg"
},
{
"type": "PACKAGE",
"url": "https://github.com/hydralabs/pyamf"
},
{
"type": "WEB",
"url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyamf/PYSEC-2020-339.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/pyamf"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2015-011.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PyAMF vulnerable to XML external entity (XXE)"
}
GHSA-M7XH-548P-355R
Vulnerability from github – Published: 2025-12-24 06:30 – Updated: 2025-12-24 06:30OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.
{
"affected": [],
"aliases": [
"CVE-2024-58335"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-24T06:15:43Z",
"severity": "MODERATE"
},
"details": "OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.",
"id": "GHSA-m7xh-548p-355r",
"modified": "2025-12-24T06:30:26Z",
"published": "2025-12-24T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58335"
},
{
"type": "WEB",
"url": "https://github.com/jcthiele/OpenXRechnungToolbox/commit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9"
},
{
"type": "WEB",
"url": "https://invoice.secvuln.info"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M84V-PJJQ-FHH8
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2024-04-04 02:37Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data.
{
"affected": [],
"aliases": [
"CVE-2019-18227"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-31T22:15:00Z",
"severity": "HIGH"
},
"details": "Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data.",
"id": "GHSA-m84v-pjjq-fhh8",
"modified": "2024-04-04T02:37:32Z",
"published": "2022-05-24T17:00:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18227"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-936"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-939"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-942"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-943"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-944"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-945"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-946"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-947"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-953"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-954"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-959"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.