CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1822 vulnerabilities reference this CWE, most recent first.
GHSA-7GG3-QCCG-9CGW
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.
{
"affected": [],
"aliases": [
"CVE-2018-1747"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-15T13:29:00Z",
"severity": "HIGH"
},
"details": "IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.",
"id": "GHSA-7gg3-qccg-9cgw",
"modified": "2022-05-13T01:32:44Z",
"published": "2022-05-13T01:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1747"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148428"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10733429"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7GGC-24WF-8F5X
Vulnerability from github – Published: 2025-11-03 21:34 – Updated: 2025-11-03 21:34IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2025-12531"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-03T20:17:06Z",
"severity": "HIGH"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
"id": "GHSA-7ggc-24wf-8f5x",
"modified": "2025-11-03T21:34:43Z",
"published": "2025-11-03T21:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12531"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7249881"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GP3-PRR3-4599
Vulnerability from github – Published: 2026-09-28 09:30 – Updated: 2026-09-28 09:30Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.
{
"affected": [],
"aliases": [
"CVE-2026-82386"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-28T08:16:42Z",
"severity": "HIGH"
},
"details": "Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator bookmark-import action. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which uses a hardened parser that disables external entities and document type declarations.",
"id": "GHSA-7gp3-prr3-4599",
"modified": "2026-09-28T09:30:28Z",
"published": "2026-09-28T09:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82386"
},
{
"type": "WEB",
"url": "https://github.com/apache/roller/pull/173"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/mrtstv8odj7l9mcrto445lftrcpw0sxl"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/09/25/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7GW5-HW8M-8P4X
Vulnerability from github – Published: 2022-05-14 03:41 – Updated: 2022-05-14 03:41A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.
{
"affected": [],
"aliases": [
"CVE-2018-3600"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-09T22:29:00Z",
"severity": "MODERATE"
},
"details": "A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.",
"id": "GHSA-7gw5-hw8m-8p4x",
"modified": "2022-05-14T03:41:34Z",
"published": "2022-05-14T03:41:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3600"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/1119158"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-111"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7H6C-R5X6-JGC8
Vulnerability from github – Published: 2025-07-18 18:30 – Updated: 2025-07-18 21:30agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.
{
"affected": [],
"aliases": [
"CVE-2025-52162"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-18T17:15:44Z",
"severity": "MODERATE"
},
"details": "agorum Software GmbH Agorum core open v11.9.2 \u0026 v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.",
"id": "GHSA-7h6c-r5x6-jgc8",
"modified": "2025-07-18T21:30:28Z",
"published": "2025-07-18T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52162"
},
{
"type": "WEB",
"url": "https://herolab.usd.de/security-advisories/usd-2025-0024"
},
{
"type": "WEB",
"url": "http://agorum.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7H8F-9M99-6CFG
Vulnerability from github – Published: 2022-01-14 00:02 – Updated: 2022-01-20 00:02AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
{
"affected": [],
"aliases": [
"CVE-2021-40722"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-13T21:15:00Z",
"severity": "CRITICAL"
},
"details": "AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.",
"id": "GHSA-7h8f-9m99-6cfg",
"modified": "2022-01-20T00:02:11Z",
"published": "2022-01-14T00:02:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40722"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7HC6-6VRH-XWQX
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 142597.
{
"affected": [],
"aliases": [
"CVE-2018-1542"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-06T14:29:00Z",
"severity": "HIGH"
},
"details": "IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 142597.",
"id": "GHSA-7hc6-6vrh-xwqx",
"modified": "2022-05-13T01:33:09Z",
"published": "2022-05-13T01:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1542"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142597"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22015943"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7JC7-G598-2P64
Vulnerability from github – Published: 2026-01-20 18:31 – Updated: 2026-01-21 16:56An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.2"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-65482"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-21T16:56:55Z",
"nvd_published_at": "2026-01-20T16:16:06Z",
"severity": "CRITICAL"
},
"details": "An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.",
"id": "GHSA-7jc7-g598-2p64",
"modified": "2026-01-21T16:56:55Z",
"published": "2026-01-20T18:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65482"
},
{
"type": "WEB",
"url": "https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332"
},
{
"type": "WEB",
"url": "https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing"
},
{
"type": "WEB",
"url": "https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-"
},
{
"type": "PACKAGE",
"url": "https://github.com/opensagres/xdocreport"
},
{
"type": "WEB",
"url": "https://hackmd.io/@cuongnh/r1B7B8fJ-g"
},
{
"type": "WEB",
"url": "https://hackmd.io/@cuongnh/rkJPCgSy-l"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XDocReport affected by an XML External Entity (XXE) vulnerability"
}
GHSA-7JH8-C237-CVQ4
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2024-04-04 02:45XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.
{
"affected": [],
"aliases": [
"CVE-2019-19032"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-91"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-30T20:15:00Z",
"severity": "HIGH"
},
"details": "XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.",
"id": "GHSA-7jh8-c237-cvq4",
"modified": "2024-04-04T02:45:55Z",
"published": "2022-05-24T17:05:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19032"
},
{
"type": "WEB",
"url": "https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156139/XMLBlueprint-16.191112-XML-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JMX-9C9V-P8W8
Vulnerability from github – Published: 2025-05-14 18:30 – Updated: 2025-05-14 18:30CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos through version 1.1.0.
{
"affected": [],
"aliases": [
"CVE-2025-4639"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-14T18:15:33Z",
"severity": "HIGH"
},
"details": "CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos through version 1.1.0.",
"id": "GHSA-7jmx-9c9v-p8w8",
"modified": "2025-05-14T18:30:51Z",
"published": "2025-05-14T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4639"
},
{
"type": "WEB",
"url": "https://github.com/Peergos/Peergos/pull/1267"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.