Weakness (CWE)
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it (1 mitigation)
-
Implementation, System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
Source: MITRE CWE-611
23 results · Clear filters · Feed
-
High 7.5CVE-2026-90885 Public exploit
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery…
-
High 8.2CVE-2026-88901 Public exploit
Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smo…
-
High 7.5CVE-2026-85250 Public exploit
Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload st…
-
High 8.6CVE-2026-88789 Public exploit
Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document …
-
High 8.7CVE-2026-45071 Public exploit
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity reso…
-
High 7.5CVE-2026-22016 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 8.1
Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
-
High 8.4
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…
-
High 8.2
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…
KEV Dec 11, 2025 -
High 8.4
N-central Multiple XXE Injection Vulnerabilities
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
-
High 8.4
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensiti…
-
High 8.0CVE-2025-7766 Public exploit
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
-
High 8.3CVE-2024-52806 Public exploit
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
-
High 8.3
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy S…
-
High 8.6CVE-2023-45612 Public exploit
In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
-
High 7.5CVE-2022-38840 Public exploit
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upl…
-
High 7.3CVE-2022-0265 Public exploit
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
-
High 7.8CVE-2021-46365 Public exploit
Improper Restriction of XML External Entity Reference in Magnolia CMS
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.
-
High 7.1
WordPress Authenticated XXE attack when installation is running PHP 8
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…
-
High 7.5CVE-2018-11761 Public exploit
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
-
High 7.5CVE-2018-1259 Public exploit
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…
-
High 8.8CVE-2017-9096 Public exploit
Improper Restriction of XML External Entity Reference in iText
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
-
High 7.5
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.