Description
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NextGen Healthcare | Mirth Connect | ≤ 4.7.1 | 4.7.2 |
Advisories 1
- ICSMA-26-253-01 NextGen Healthcare Mirth Connect CISA ICS & IT advisories · Sep 10, 2026