Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1827 vulnerabilities reference this CWE, most recent first.
GHSA-JW8H-7CCV-VQ64
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-14 21:31
VLAI
Details
IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-13107"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:00Z",
"severity": "HIGH"
},
"details": "IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.",
"id": "GHSA-jw8h-7ccv-vq64",
"modified": "2026-09-14T21:31:46Z",
"published": "2026-09-14T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13107"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7285930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JWQ9-92HC-XQ2J
Vulnerability from github – Published: 2026-08-12 18:31 – Updated: 2026-08-12 18:31
VLAI
Details
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-15803"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T16:16:54Z",
"severity": "HIGH"
},
"details": "In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.",
"id": "GHSA-jwq9-92hc-xq2j",
"modified": "2026-08-12T18:31:17Z",
"published": "2026-08-12T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15803"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/175"
},
{
"type": "WEB",
"url": "https://rdf4j.org/release-notes/5.3.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JWWR-FJGH-CV2X
Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2026-04-16 18:07
VLAI
Summary
Improper Restriction of XML External Entity Reference in Castor
Details
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.codehaus.castor:castor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "castor:castor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3004"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T22:43:25Z",
"nvd_published_at": "2014-06-11T14:55:00Z",
"severity": "MODERATE"
},
"details": "The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.",
"id": "GHSA-jwwr-fjgh-cv2x",
"modified": "2026-04-16T18:07:55Z",
"published": "2022-05-13T01:05:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3004"
},
{
"type": "PACKAGE",
"url": "https://github.com/castor-data-binding/castor"
},
{
"type": "WEB",
"url": "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/May/142"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Restriction of XML External Entity Reference in Castor"
}
GHSA-JX49-FPHC-W293
Vulnerability from github – Published: 2026-03-19 12:30 – Updated: 2026-03-19 12:30
VLAI
Details
Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.
Severity
8.6 (High)
{
"affected": [],
"aliases": [
"CVE-2026-3511"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-19T12:16:18Z",
"severity": "HIGH"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.",
"id": "GHSA-jx49-fphc-w293",
"modified": "2026-03-19T12:30:33Z",
"published": "2026-03-19T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3511"
},
{
"type": "WEB",
"url": "https://blog.binary.house/2026/03/pripadova-studia-ako-sme-s-claude-code.html"
},
{
"type": "WEB",
"url": "https://github.com/slovensko-digital/autogram/releases/tag/v2.7.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JXG2-8MCP-74Q3
Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2024-02-29 03:33
VLAI
Details
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-25926"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:38:24Z",
"severity": "MODERATE"
},
"details": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.",
"id": "GHSA-jxg2-8mcp-74q3",
"modified": "2024-02-29T03:33:12Z",
"published": "2024-02-29T03:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25926"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247599"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6964516"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JXG7-VV7X-X8FJ
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33
VLAI
Details
IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2018-1421"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-04T18:29:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023.",
"id": "GHSA-jxg7-vv7x-x8fj",
"modified": "2022-05-13T01:33:18Z",
"published": "2022-05-13T01:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1421"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139023"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22015055"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JXM5-5XCW-H57Q
Vulnerability from github – Published: 2018-12-20 22:02 – Updated: 2022-11-15 16:07
VLAI
Summary
exist-db:exist-core XML External Entity (XXE) vulnerability
Details
exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Severity
10.0 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.exist-db:exist-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000823"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:44:26Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "exist version \u003c= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.",
"id": "GHSA-jxm5-5xcw-h57q",
"modified": "2022-11-15T16:07:28Z",
"published": "2018-12-20T22:02:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000823"
},
{
"type": "WEB",
"url": "https://github.com/eXist-db/exist/issues/2180"
},
{
"type": "WEB",
"url": "https://github.com/eXist-db/exist/pull/2243"
},
{
"type": "WEB",
"url": "https://github.com/eXist-db/exist/pull/2247"
},
{
"type": "WEB",
"url": "https://github.com/eXist-db/exist/commit/1c3f0aec14d00bdbca175713af70cb7c7b868e9f"
},
{
"type": "WEB",
"url": "https://github.com/eXist-db/exist/commit/b210f9fbf379b68842f2b055dda80d7e7479e96f"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/27/exist-XXE"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jxm5-5xcw-h57q"
},
{
"type": "PACKAGE",
"url": "https://github.com/eXist-db/exist"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "exist-db:exist-core XML External Entity (XXE) vulnerability"
}
GHSA-JXP8-6VCM-W6JC
Vulnerability from github – Published: 2026-09-08 18:31 – Updated: 2026-09-09 21:31
VLAI
Details
An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-79572"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T16:18:14Z",
"severity": "HIGH"
},
"details": "An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload.",
"id": "GHSA-jxp8-6vcm-w6jc",
"modified": "2026-09-09T21:31:18Z",
"published": "2026-09-08T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79572"
},
{
"type": "WEB",
"url": "https://github.com/fangtang7/CVE/blob/main/Distribution%20Management/XXE.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M24F-WH87-6PQQ
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49
VLAI
Details
A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-29140"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T13:15:00Z",
"severity": "HIGH"
},
"details": "A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.",
"id": "GHSA-m24f-wh87-6pqq",
"modified": "2022-05-24T17:49:13Z",
"published": "2022-05-24T17:49:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29140"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-009.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M269-WJ6G-C459
Vulnerability from github – Published: 2022-05-17 02:56 – Updated: 2024-10-24 21:52
VLAI
Summary
PySAML2 XML external entity attack
Details
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Severity
9.0 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pysaml2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10127"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-17T21:31:28Z",
"nvd_published_at": "2017-03-03T15:59:00Z",
"severity": "CRITICAL"
},
"details": "PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.",
"id": "GHSA-m269-wj6g-c459",
"modified": "2024-10-24T21:52:38Z",
"published": "2022-05-17T02:56:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10127"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/issues/366"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/pull/379"
},
{
"type": "WEB",
"url": "https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m269-wj6g-c459"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2017-67.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/rohe/pysaml2"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227195127/http://www.securityfocus.com/bid/95376"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/01/19/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "PySAML2 XML external entity attack"
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.