CWE-611 Improper Restriction of XML External Entity Reference
Description
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-611 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-xw5h-cmh3-8j6j | CVE-2026-49875 | CRITICAL |
Apache CXF has Improper Restriction of XML External Entity Reference |
2026-10-02 | |
| GHSA-4v8g-86x5-3vrc | CVE-2026-40682 | CRITICAL |
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing |
2026-10-02 | |
| GHSA-xm28-xvqc-gxxg | CVE-2026-61586 | HIGH |
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution |
2026-10-02 | |
| GHSA-fj2m-w3wv-x9pr | CVE-2022-39135 | CRITICAL |
Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack |
2026-09-29 | |
| GHSA-cjx3-73hr-rpw7 | CVE-2026-61741 | CRITICAL |
http4s-scala-xml has an XML External Entity (XXE) processing issue |
2026-09-24 | |
| GHSA-3446-6mgw-f79p | CVE-2026-56701 | MODERATE | - |
Grav is Vulnerable to XXE via SVG Upload |
2026-09-23 |
| GHSA-32fw-h446-j4hh | - | HIGH | - |
Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload |
2026-09-23 |
| GHSA-5vvx-3h34-f3gj | CVE-2026-61570 | HIGH |
MPXJ: XXE Vulnerability in MerlinReader |
2026-09-22 | |
| GHSA-5v29-34h8-v68r | CVE-2026-55848 | HIGH |
MapFish Print has XXE that allows reading arbitrary files of certain types |
2026-08-28 | |
| GHSA-m88r-rg27-5xfg | CVE-2026-44020 | HIGH |
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend |
2026-08-28 | |
| GHSA-2mpf-m756-hxjm | CVE-2026-40998 | HIGH |
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource |
2026-08-21 | |
| GHSA-6rpq-6vv2-5222 | CVE-2026-40991 | MODERATE |
Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference |
2026-08-12 | |
| GHSA-cg9x-g3gm-h5h6 | CVE-2026-54082 | MODERATE |
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs |
2026-07-29 | |
| GHSA-3jh7-wm29-q568 | CVE-2026-54078 | HIGH |
veraPDF Validation XXE via Rich Text |
2026-07-29 | |
| GHSA-36mm-w85j-3q2j | CVE-2026-54079 | HIGH |
veraPDF Validation XXE via XFA |
2026-07-29 | |
| GHSA-4qhr-g3c6-fcfx | CVE-2026-56817 | HIGH |
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling |
2026-07-22 | |
| GHSA-r3xg-rg9j-67fv | CVE-2026-44018 | MODERATE |
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend |
2026-07-21 | |
| GHSA-7v6w-c3f4-9wpq | CVE-2026-54640 | HIGH |
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory |
2026-07-06 | |
| GHSA-vmm5-fjgx-2jhp | CVE-2026-44618 | MODERATE |
Apache CXF's WS-Transfer module has an insecure XML parser configuration |
2026-06-29 | |
| GHSA-fq39-62gx-8hqx | CVE-2026-46722 | MODERATE | - |
TYPO3 ke_search XML External Entity Injection |
2026-06-29 |
| GHSA-8678-w3jw-xfc2 | - | LOW |
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 |
2026-06-19 | |
| GHSA-2f55-g35j-5jmf | CVE-2026-55471 | CRITICAL |
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory |
2026-06-17 | |
| GHSA-x4r9-gmw3-hxww | CVE-2025-58175 | MODERATE |
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution |
2026-06-12 | |
| GHSA-7mj5-hjjj-8rgw | CVE-2024-55875 | CRITICAL |
http4k has a potential XXE (XML External Entity Injection) vulnerability |
2026-06-09 | |
| GHSA-vfmq-68hx-4jfw | CVE-2026-41066 | HIGH |
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files |
2026-06-06 |