CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1695 vulnerabilities reference this CWE, most recent first.
GHSA-7G3H-38QP-PX8V
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2018-4942"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-19T17:29:00Z",
"severity": "HIGH"
},
"details": "Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.",
"id": "GHSA-7g3h-38qp-px8v",
"modified": "2022-05-13T01:17:38Z",
"published": "2022-05-13T01:17:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4942"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103718"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7G3H-G9H9-3G4R
Vulnerability from github – Published: 2022-05-14 01:42 – Updated: 2022-05-14 01:42FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.
{
"affected": [],
"aliases": [
"CVE-2018-1000825"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "FreeCol version \u003c= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.",
"id": "GHSA-7g3h-g9h9-3g4r",
"modified": "2022-05-14T01:42:23Z",
"published": "2022-05-14T01:42:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000825"
},
{
"type": "WEB",
"url": "https://github.com/FreeCol/freecol/issues/26"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/28/freecol-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7G54-VGP6-JJ5W
Vulnerability from github – Published: 2022-05-17 02:26 – Updated: 2022-11-03 20:48In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.sling:org.apache.sling.xss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.sling:org.apache.sling.xss.compat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-6798"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-03T20:48:21Z",
"nvd_published_at": "2017-07-19T15:29:00Z",
"severity": "CRITICAL"
},
"details": "In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.",
"id": "GHSA-7g54-vgp6-jj5w",
"modified": "2022-11-03T20:48:21Z",
"published": "2022-05-17T02:26:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6798"
},
{
"type": "WEB",
"url": "https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529"
},
{
"type": "WEB",
"url": "https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-6798"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0@%3Cdev.sling.apache.org%3E"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache Sling"
}
GHSA-7G64-F2HM-VJXP
Vulnerability from github – Published: 2026-06-26 00:32 – Updated: 2026-06-30 03:37A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
{
"affected": [],
"aliases": [
"CVE-2026-12975"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T22:17:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.",
"id": "GHSA-7g64-f2hm-vjxp",
"modified": "2026-06-30T03:37:14Z",
"published": "2026-06-26T00:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12975"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12975"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491688"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GF7-JV65-WJMH
Vulnerability from github – Published: 2023-06-05 06:30 – Updated: 2025-01-08 19:00The xml-rs crate >= 0.8.9 and < 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "xml-rs"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.9"
},
{
"fixed": "0.8.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-34411"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-617"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-06T02:06:58Z",
"nvd_published_at": "2023-06-05T04:15:11Z",
"severity": "HIGH"
},
"details": "The xml-rs crate \u003e= 0.8.9 and \u003c 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid \u003c! token (such as \u003c!DOCTYPEs/%\u003c!A nesting) in an XML document.",
"id": "GHSA-7gf7-jv65-wjmh",
"modified": "2025-01-08T19:00:56Z",
"published": "2023-06-05T06:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34411"
},
{
"type": "WEB",
"url": "https://github.com/netvl/xml-rs/pull/226"
},
{
"type": "WEB",
"url": "https://github.com/00xc/xml-rs/commit/0f084d45aa53e4a27476961785f59f2bd7d59a9f"
},
{
"type": "WEB",
"url": "https://github.com/netvl/xml-rs/commit/014d808be900c85a0afc5ccdfe668be040d175aa"
},
{
"type": "WEB",
"url": "https://github.com/netvl/xml-rs/commit/c09549a187e62d39d40467f129e64abf32efc35c"
},
{
"type": "PACKAGE",
"url": "https://github.com/netvl/xml-rs"
},
{
"type": "WEB",
"url": "https://github.com/netvl/xml-rs/compare/0.8.13...0.8.14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "xml-rs vulnerable to denial of service via invalid token in XML document"
}
GHSA-7GG3-QCCG-9CGW
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.
{
"affected": [],
"aliases": [
"CVE-2018-1747"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-15T13:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.",
"id": "GHSA-7gg3-qccg-9cgw",
"modified": "2022-05-13T01:32:44Z",
"published": "2022-05-13T01:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1747"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148428"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10733429"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7GGC-24WF-8F5X
Vulnerability from github – Published: 2025-11-03 21:34 – Updated: 2025-11-03 21:34IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2025-12531"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-03T20:17:06Z",
"severity": "HIGH"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-7ggc-24wf-8f5x",
"modified": "2025-11-03T21:34:43Z",
"published": "2025-11-03T21:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12531"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7249881"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GW5-HW8M-8P4X
Vulnerability from github – Published: 2022-05-14 03:41 – Updated: 2022-05-14 03:41A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.
{
"affected": [],
"aliases": [
"CVE-2018-3600"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-09T22:29:00Z",
"severity": "MODERATE"
},
"details": "A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.",
"id": "GHSA-7gw5-hw8m-8p4x",
"modified": "2022-05-14T03:41:34Z",
"published": "2022-05-14T03:41:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3600"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/1119158"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-111"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7H6C-R5X6-JGC8
Vulnerability from github – Published: 2025-07-18 18:30 – Updated: 2025-07-18 21:30agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.
{
"affected": [],
"aliases": [
"CVE-2025-52162"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-18T17:15:44Z",
"severity": "MODERATE"
},
"details": "agorum Software GmbH Agorum core open v11.9.2 \u0026 v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.",
"id": "GHSA-7h6c-r5x6-jgc8",
"modified": "2025-07-18T21:30:28Z",
"published": "2025-07-18T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52162"
},
{
"type": "WEB",
"url": "https://herolab.usd.de/security-advisories/usd-2025-0024"
},
{
"type": "WEB",
"url": "http://agorum.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7H8F-9M99-6CFG
Vulnerability from github – Published: 2022-01-14 00:02 – Updated: 2022-01-20 00:02AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
{
"affected": [],
"aliases": [
"CVE-2021-40722"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-13T21:15:00Z",
"severity": "CRITICAL"
},
"details": "AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.",
"id": "GHSA-7h8f-9m99-6cfg",
"modified": "2022-01-20T00:02:11Z",
"published": "2022-01-14T00:02:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40722"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.