Most recent entries from all

EUVD-2026-26529

2026-10-16T08:06:26.547618+00:00

EUVD-2026-26529

fkie_cve-2021-29620

2026-10-16T08:06:26.547657+00:00

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.

GHSA-24wf-7vf2-pv59 — XXE vulnerability on Launch import with externally-defined DTD file

2026-10-16T08:06:26.547714+00:00

Affected: Maven: com.epam.reportportal:service-api

### Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

### Patches Fixed with: https://github.com/reportportal/service-api/pull/1392

### Binaries `docker pull reportportal/service-api:5.4.0` https://github.com/reportportal/service-api/packages/846871?version=5.4.0

### For more information If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)

gsd-2021-29620

2026-10-16T08:06:26.547747+00:00

gsd-2021-29620