Description
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.drools:drools-core | < 6.2.0.Final | 6.2.0.Final | GHSA-6qx9-rf9g-7jmr |
| Maven | org.jbpm:jbpm-bpmn2 | < 6.2.0.Final | 6.2.0.Final | GHSA-6qx9-rf9g-7jmr |
Advisories 1
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026