Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1749 vulnerabilities reference this CWE, most recent first.
GHSA-4Q2R-QXP6-H5J6
Vulnerability from github – Published: 2021-08-30 16:25 – Updated: 2024-10-16 21:33
VLAI
Summary
Improper Restriction of XML External Entity Reference in Quokka
Details
XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "quokka"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-18705"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-26T16:34:46Z",
"nvd_published_at": "2021-08-16T18:15:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component \u0027quokka/core/content/views.py\u0027.",
"id": "GHSA-4q2r-qxp6-h5j6",
"modified": "2024-10-16T21:33:50Z",
"published": "2021-08-30T16:25:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-18705"
},
{
"type": "WEB",
"url": "https://github.com/rochacbruno/quokka/issues/676"
},
{
"type": "WEB",
"url": "https://github.com/quokkaproject/quokka/pull/679"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/quokka/PYSEC-2021-145.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/rochacbruno/quokka"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Quokka"
}
GHSA-4QHH-VHVG-GC9C
Vulnerability from github – Published: 2026-08-17 18:31 – Updated: 2026-08-17 18:31
VLAI
Details
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-75058"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T16:17:52Z",
"severity": "MODERATE"
},
"details": "In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers",
"id": "GHSA-4qhh-vhvg-gc9c",
"modified": "2026-08-17T18:31:20Z",
"published": "2026-08-17T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75058"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4QHR-G3C6-FCFX
Vulnerability from github – Published: 2026-07-22 21:43 – Updated: 2026-07-22 21:43
VLAI
Summary
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Details
Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.15.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-xml"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Final"
},
{
"fixed": "4.2.16.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.135.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-xml"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0.Final"
},
{
"fixed": "4.1.136.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-56817"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T21:43:16Z",
"nvd_published_at": "2026-07-21T23:17:52Z",
"severity": "HIGH"
},
"details": "Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration \u2014 but whether external entities are actually resolved depends on Aalto XML\u0027s async parser behavior, making this a confirmed misconfiguration with conditional exploitability.",
"id": "GHSA-4qhr-g3c6-fcfx",
"modified": "2026-07-22T21:43:17Z",
"published": "2026-07-22T21:43:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56817"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Netty XML: Injection / Risky Sink \u2014 unconfigured XML factory with active DTD and entity handling"
}
GHSA-4QR6-CJV5-78XJ
Vulnerability from github – Published: 2026-01-17 09:31 – Updated: 2026-01-17 09:31
VLAI
Details
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-14478"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-17T08:15:51Z",
"severity": "HIGH"
},
"details": "The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.",
"id": "GHSA-4qr6-cjv5-78xj",
"modified": "2026-01-17T09:31:14Z",
"published": "2026-01-17T09:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14478"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4QV7-MVG8-3455
Vulnerability from github – Published: 2022-06-03 00:00 – Updated: 2022-06-14 00:00
VLAI
Details
NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-45981"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T18:15:00Z",
"severity": "CRITICAL"
},
"details": "NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.",
"id": "GHSA-4qv7-mvg8-3455",
"modified": "2022-06-14T00:00:37Z",
"published": "2022-06-03T00:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45981"
},
{
"type": "WEB",
"url": "https://netscout.com"
},
{
"type": "WEB",
"url": "https://www.netscout.com/securityadvisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4R2R-HJRW-MPQ6
Vulnerability from github – Published: 2024-11-08 12:31 – Updated: 2024-11-13 21:30
VLAI
Details
Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.
Severity
8.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-10839"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-08T11:15:03Z",
"severity": "HIGH"
},
"details": "Zohocorp ManageEngine SharePoint Manager Plus versions\u00a04503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.",
"id": "GHSA-4r2r-hjrw-mpq6",
"modified": "2024-11-13T21:30:31Z",
"published": "2024-11-08T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10839"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4R4V-5CJX-R22J
Vulnerability from github – Published: 2022-05-14 01:21 – Updated: 2022-05-14 01:21
VLAI
Details
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-0277"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-12T22:29:00Z",
"severity": "MODERATE"
},
"details": "SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).",
"id": "GHSA-4r4v-5cjx-r22j",
"modified": "2022-05-14T01:21:15Z",
"published": "2022-05-14T01:21:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0277"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2764283"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107356"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4RF8-J9GH-8QPH
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2024-04-04 02:36
VLAI
Details
An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-9757"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-29T19:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.",
"id": "GHSA-4rf8-j9gh-8qph",
"modified": "2024-04-04T02:36:23Z",
"published": "2022-05-24T17:00:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9757"
},
{
"type": "WEB",
"url": "https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9757"
},
{
"type": "WEB",
"url": "https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RJ6-9PJH-882R
Vulnerability from github – Published: 2022-05-14 03:40 – Updated: 2022-06-30 19:45
VLAI
Summary
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Details
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Severity
8.3 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.23"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:junit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000056"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-30T19:45:12Z",
"nvd_published_at": "2018-02-09T23:29:00Z",
"severity": "HIGH"
},
"details": "Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.",
"id": "GHSA-4rj6-9pjh-882r",
"modified": "2022-06-30T19:45:12Z",
"published": "2022-05-14T03:40:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000056"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/junit-plugin/commit/15f39fc49d9f25bca872badb48e708a8bb815ea7"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/junit-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-02-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin"
}
GHSA-4RJJ-V6CR-F48F
Vulnerability from github – Published: 2023-03-22 00:30 – Updated: 2023-03-24 06:30
VLAI
Details
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-46286"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-21T23:15:00Z",
"severity": "MODERATE"
},
"details": "Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.",
"id": "GHSA-4rjj-v6cr-f48f",
"modified": "2023-03-24T06:30:16Z",
"published": "2023-03-22T00:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46286"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.