Skip to content
OpenAdvisories
Low · 2.8 CVE-2025-66372 EUVD-2025-199853GHSA-x832-fpvj-r5ph

Mustangproject allows exfiltrating files via XXE attacks

Published Nov 28, 2025 · Updated Dec 3, 2025 · Assigned by mitre

Vendor: mustangproject Product: Mustang Package: org.mustangproject:library Package: org.mustangproject:validator Ecosystem: Maven

Description

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

Affected products

VendorProductAffectedFixed
mustangproject Mustang < 2.16.3 2.16.3

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.mustangproject:library < 2.16.3 2.16.3 GHSA-x832-fpvj-r5ph
Maven org.mustangproject:validator < 2.16.3 2.16.3 GHSA-x832-fpvj-r5ph

References