CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1831 vulnerabilities reference this CWE, most recent first.
GHSA-8X6X-VW5H-Q563
Vulnerability from github – Published: 2026-09-15 00:31 – Updated: 2026-09-15 00:31Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
{
"affected": [],
"aliases": [
"CVE-2026-91197"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T23:19:00Z",
"severity": "HIGH"
},
"details": "Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.",
"id": "GHSA-8x6x-vw5h-q563",
"modified": "2026-09-15T00:31:15Z",
"published": "2026-09-15T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91197"
},
{
"type": "WEB",
"url": "https://github.com/flowable/flowable-engine/issues/4216"
},
{
"type": "WEB",
"url": "https://github.com/flowable/flowable-engine"
},
{
"type": "WEB",
"url": "https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable-engine/src/main/java/org/flowable/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L101-L118"
},
{
"type": "WEB",
"url": "https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L97-L114"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/flowable-flowable-engine-through-8.0.0-xxe-via-processdiagramlayoutfactory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8XMW-6Q27-4H39
Vulnerability from github – Published: 2022-05-14 02:04 – Updated: 2022-05-14 02:04VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [],
"aliases": [
"CVE-2016-7459"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-29T09:59:00Z",
"severity": "HIGH"
},
"details": "VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-8xmw-6q27-4h39",
"modified": "2022-05-14T02:04:18Z",
"published": "2022-05-14T02:04:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7459"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94486"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037329"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2016-0022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XV9-QCR9-WW9J
Vulnerability from github – Published: 2020-10-19 21:32 – Updated: 2021-10-04 21:28Impact
Authenticated XML External Entity Processing
Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.3.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-10-19T21:32:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nAuthenticated XML External Entity Processing\n\n### Patches\nWe recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020",
"id": "GHSA-8xv9-qcr9-ww9j",
"modified": "2021-10-04T21:28:06Z",
"published": "2020-10-19T21:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/platform/security/advisories/GHSA-8xv9-qcr9-ww9j"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/platform"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PHP-SHOPWAREPLATFORM-1019470"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Authenticated XML External Entity Processing"
}
GHSA-8XX8-9G4G-C4Q2
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
{
"affected": [],
"aliases": [
"CVE-2016-2908"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-01T20:59:00Z",
"severity": "CRITICAL"
},
"details": "IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.",
"id": "GHSA-8xx8-9g4g-c4q2",
"modified": "2022-05-13T01:14:03Z",
"published": "2022-05-13T01:14:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2908"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995531"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95295"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038506"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XXP-2WXG-R73W
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2021-21470"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T15:15:00Z",
"severity": "MODERATE"
},
"details": "SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.",
"id": "GHSA-8xxp-2wxg-r73w",
"modified": "2022-05-24T17:38:55Z",
"published": "2022-05-24T17:38:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21470"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3000291"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-927C-C24Q-W7GX
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-12-03 00:30IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 164555.
{
"affected": [],
"aliases": [
"CVE-2019-4513"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-26T15:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 164555.",
"id": "GHSA-927c-c24q-w7gx",
"modified": "2022-12-03T00:30:20Z",
"published": "2022-05-24T16:54:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4513"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/164555"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10996716"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-92H7-3MPG-68JH
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.
{
"affected": [],
"aliases": [
"CVE-2021-30137"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-15T13:15:00Z",
"severity": "HIGH"
},
"details": "Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.",
"id": "GHSA-92h7-3mpg-68jh",
"modified": "2022-05-24T19:14:40Z",
"published": "2022-05-24T19:14:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30137"
},
{
"type": "WEB",
"url": "https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-92J5-798V-G55R
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2016-9924"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-29T14:59:00Z",
"severity": "CRITICAL"
},
"details": "Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.",
"id": "GHSA-92j5-798v-g55r",
"modified": "2022-05-13T01:26:00Z",
"published": "2022-05-13T01:26:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9924"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Security_Center"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-92WH-XP96-V6MJ
Vulnerability from github – Published: 2026-09-11 18:31 – Updated: 2026-09-11 18:31MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
{
"affected": [],
"aliases": [
"CVE-2026-89260"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T16:17:50Z",
"severity": "HIGH"
},
"details": "MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.",
"id": "GHSA-92wh-xp96-v6mj",
"modified": "2026-09-11T18:31:25Z",
"published": "2026-09-11T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89260"
},
{
"type": "WEB",
"url": "https://gitee.com/moxi159753/mogu_blog_v2/releases"
},
{
"type": "WEB",
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py"
},
{
"type": "WEB",
"url": "https://github.com/moxi624/mogu_blog_v2"
},
{
"type": "WEB",
"url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java"
},
{
"type": "WEB",
"url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-92WJ-X78C-M4FX
Vulnerability from github – Published: 2019-01-07 19:14 – Updated: 2023-09-11 22:40Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf.specs:org.apache.karaf.specs.java.xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-11788"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:27:16Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Apache Karaf provides a features deployer, which allows users to \"hot deploy\" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn\u0027t contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.",
"id": "GHSA-92wj-x78c-m4fx",
"modified": "2023-09-11T22:40:24Z",
"published": "2019-01-07T19:14:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"
},
{
"type": "WEB",
"url": "https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/karaf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479"
},
{
"type": "WEB",
"url": "http://karaf.apache.org/security/cve-2018-11788.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in Apache Karaf"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.