Description

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T08:17:11.707Z",
  "pubdate": "2026-09-08T08:17:11.707Z",
  "executiveSummary": "Cosminexus Component Container is susceptible to an Improper Restriction of XML External Entity (XXE) Reference vulnerability. This security flaw stems from the insecure configuration of XML parsers used by the application, which allows for the processing of external entities during the parsing of XML input.\nBy submitting a crafted XML document containing a Document Type Definition (DTD) that specifies an external entity, an unauthenticated remote attacker can force the application to disclose sensitive information, perform Server-Side Request Forgery (SSRF), or cause a Denial of Service (DoS) by exhausting system resources.\nThe vulnerability affects multiple versions of the Cosminexus Component Container ranging from 09-00 through 11-70-03. Exploitation does not necessarily require high-level privileges, depending on the application context, but necessitates the ability to provide input to an XML-parsing function. The risk is significant as it potentially exposes local files, internal network resources, or confidential system data.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the underlying XML parsing library within the Cosminexus Component Container to properly disable the resolution of external entities. When an XML processor is not configured to ignore DTDs or disable external entity expansion, it becomes susceptible to processing malicious input that includes references to external URIs.\nThe attack flow begins when an attacker sends a specially crafted HTTP request containing an XML payload to an endpoint processed by the vulnerable component. This payload includes a DOCTYPE declaration defining an external entity, such as SYSTEM or PUBLIC, which points to a local system file (e.g., file:///etc/passwd) or an internal network resource (e.g., http://internal-service/admin).\nUpon receiving the request, the XML parser interprets the DTD and attempts to resolve the external entity. Because the parser is improperly configured, it retrieves the content from the specified URI and substitutes the entity reference with the fetched content. If the application reflects the processed XML content back to the user in a response, the attacker can extract the contents of the targeted file or observe the results of the SSRF attempt.\nThe affected versions include: 11-70-01 to before 11-70-03, 11-60 before 11-60-03, 11-50 through 11-50-03, 11-40 through 11-40-03, 11-30 through 11-30-08, 11-20 before 11-20-10, 11-10 through 11-10-11, 11-00 before 11-00-13, 09-87 before 09-87-10, 09-80 before 09-80-05, 09-70 before 09-70-28, 09-50 through 09-50-22, and 09-00 through 09-00-18.\nExploitation can lead to full read access of files readable by the application process, scanning of internal network infrastructure otherwise protected by firewalls, and potential resource exhaustion (Billion Laughs attack) leading to service outages. Successful exploitation is highly dependent on the application's configuration and whether it returns results to the attacker (in-band XXE) or requires blind techniques to exfiltrate data."
}