CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1694 vulnerabilities reference this CWE, most recent first.
GHSA-F67Q-PRQ8-2XC6
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.
{
"affected": [],
"aliases": [
"CVE-2018-1970"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-04T21:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.",
"id": "GHSA-f67q-prq8-2xc6",
"modified": "2022-05-13T01:32:26Z",
"published": "2022-05-13T01:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1970"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/153751"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10796380"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F68W-VGHW-39X8
Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of xml files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18563.
{
"affected": [],
"aliases": [
"CVE-2023-51601"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:16:21Z",
"severity": "MODERATE"
},
"details": "Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of xml files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-18563.",
"id": "GHSA-f68w-vghw-39x8",
"modified": "2024-05-03T03:31:08Z",
"published": "2024-05-03T03:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51601"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1850"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F6QG-V8FC-R2P3
Vulnerability from github – Published: 2022-07-26 00:01 – Updated: 2022-08-02 00:00OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
{
"affected": [],
"aliases": [
"CVE-2022-2131"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-25T15:15:00Z",
"severity": "CRITICAL"
},
"details": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.",
"id": "GHSA-f6qg-v8fc-r2p3",
"modified": "2022-08-02T00:00:24Z",
"published": "2022-07-26T00:01:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2131"
},
{
"type": "WEB",
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F6RX-HF55-4255
Vulnerability from github – Published: 2025-05-15 16:08 – Updated: 2025-05-15 16:08Impact
A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References.
Patches
The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:
- 2.6.9
- 2.5.25
- 3.0.0-alpha3
Workarounds
Patch the effect file src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php in sulu with:
-$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD);
+$dom->loadXML($data, LIBXML_NONET);
References
- GitHub repository: https://github.com/sulu/sulu
- Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "sulu/sulu"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.21"
},
{
"fixed": "2.5.25"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sulu/sulu"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.5"
},
{
"fixed": "2.6.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sulu/sulu"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-alpha1"
},
{
"fixed": "3.0.0-alpha3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-47778"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-15T16:08:02Z",
"nvd_published_at": "2025-05-14T16:15:29Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References.\n\n### Patches\n\nThe problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:\n\n - 2.6.9\n - 2.5.25\n - 3.0.0-alpha3\n\n### Workarounds\n\nPatch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with:\n\n```diff\n-$dom-\u003eloadXML($svg, \\LIBXML_NOENT | \\LIBXML_DTDLOAD);\n+$dom-\u003eloadXML($data, LIBXML_NONET);\n```\n\n### References\n\n - GitHub repository: https://github.com/sulu/sulu\n - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php",
"id": "GHSA-f6rx-hf55-4255",
"modified": "2025-05-15T16:08:02Z",
"published": "2025-05-15T16:08:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47778"
},
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544"
},
{
"type": "PACKAGE",
"url": "https://github.com/sulu/sulu"
},
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Sulu vulnerable to XXE in SVG File upload Inspector"
}
GHSA-F7P7-P4M6-XXHQ
Vulnerability from github – Published: 2022-05-14 02:21 – Updated: 2022-05-14 02:21Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2016-8526"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-06T20:29:00Z",
"severity": "HIGH"
},
"details": "Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker\u0027s choosing. This could include files that contain passwords, which could then lead to privilege escalation.",
"id": "GHSA-f7p7-p4m6-xxhq",
"modified": "2022-05-14T02:21:24Z",
"published": "2022-05-14T02:21:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8526"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41482"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96495"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F7RQ-9QG8-CCHW
Vulnerability from github – Published: 2022-05-17 02:35 – Updated: 2022-05-17 02:35XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2017-9231"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T22:29:00Z",
"severity": "HIGH"
},
"details": "XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.",
"id": "GHSA-f7rq-9qg8-cchw",
"modified": "2022-05-17T02:35:49Z",
"published": "2022-05-17T02:35:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9231"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX220138"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98995"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038704"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F825-C4MJ-CWWX
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2018-13823"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-30T14:29:00Z",
"severity": "HIGH"
},
"details": "An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.",
"id": "GHSA-f825-c4mj-cwwx",
"modified": "2022-05-13T01:10:52Z",
"published": "2022-05-13T01:10:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13823"
},
{
"type": "WEB",
"url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F83Q-2CP7-QRJG
Vulnerability from github – Published: 2022-08-06 05:30 – Updated: 2024-11-18 23:02Description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
Impact
An attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0
Patches
The problem has been fixed with version 1.2.1
Workarounds
None
References
https://jvn.jp/en/jp/JVN30454777/
For more information
If you have any questions or comments about this advisory: * Open an issue
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "untangle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31471"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-06T05:30:13Z",
"nvd_published_at": "2022-07-26T06:15:00Z",
"severity": "HIGH"
},
"details": "### Description\nuntangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.\n\n### Impact\nAn attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0\n\n### Patches\nThe problem has been fixed with version 1.2.1\n\n### Workarounds\nNone\n\n### References\nhttps://jvn.jp/en/jp/JVN30454777/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an [issue](https://github.com/stchris/untangle/issues)\n",
"id": "GHSA-f83q-2cp7-qrjg",
"modified": "2024-11-18T23:02:45Z",
"published": "2022-08-06T05:30:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/stchris/untangle/security/advisories/GHSA-f83q-2cp7-qrjg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31471"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/untangle/PYSEC-2022-244.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/stchris/untangle"
},
{
"type": "WEB",
"url": "https://github.com/stchris/untangle/releases/tag/1.2.1"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN30454777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "untangle vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-F8FW-G78C-X8JH
Vulnerability from github – Published: 2022-05-17 02:53 – Updated: 2025-04-20 03:34USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.
{
"affected": [],
"aliases": [
"CVE-2017-6895"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-23T20:59:00Z",
"severity": "CRITICAL"
},
"details": "USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.",
"id": "GHSA-f8fw-g78c-x8jh",
"modified": "2025-04-20T03:34:44Z",
"published": "2022-05-17T02:53:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6895"
},
{
"type": "WEB",
"url": "https://secur1tyadvisory.wordpress.com/2017/03/15/usb-pratirodh-xml-external-entity-injection-vulnerability"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/141652/USB-Pratirodh-XXE-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Mar/42"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96936"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F8HX-F4XW-C646
Vulnerability from github – Published: 2024-07-21 12:30 – Updated: 2024-11-18 16:26RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "guardrails-ai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-6961"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-22T14:44:52Z",
"nvd_published_at": "2024-07-21T11:15:03Z",
"severity": "HIGH"
},
"details": "RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.",
"id": "GHSA-f8hx-f4xw-c646",
"modified": "2024-11-18T16:26:54Z",
"published": "2024-07-21T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6961"
},
{
"type": "WEB",
"url": "https://github.com/guardrails-ai/guardrails/pull/922"
},
{
"type": "WEB",
"url": "https://github.com/guardrails-ai/guardrails/commit/f3d806afee31e2e3f97af682d16c3c1bc0d3c380"
},
{
"type": "PACKAGE",
"url": "https://github.com/guardrails-ai/guardrails"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.