Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-11T20:18:48.973Z",
  "pubdate": "2026-08-11T20:18:48.973Z",
  "executiveSummary": "An XML External Entity (XXE) vulnerability exists in FreeCAD prior to version 1.1.2. The vulnerability arises due to the insecure construction of the Xerces SAX2 XMLReader within the Base::XMLReader::XMLReader() function located in src/Base/Reader.cpp, which parses attacker-controlled Document.xml files from crafted .FCStd archives without explicitly disabling default external entity resolution and external DTD loading. This security flaw allows malicious actors to exploit the document restoration process to read arbitrary local system files via the file URI scheme or initiate server-side requests via the http URI scheme. The resolved external content can subsequently flow through the characters() callback, potentially exposing sensitive internal data. The risk implication is significant as it enables unauthorized data disclosure and server-side request forgery through standard user interaction of opening a maliciously crafted project archive. Successful exploitation requires an attacker to deliver a specially crafted .FCStd archive containing malicious XML payloads to a victim who subsequently opens the file within an affected version of the software.",
  "technicalDetails": "The root cause of this vulnerability lies in the default configuration of the Xerces SAX2 XMLReader utilized by FreeCAD for parsing XML-based project structures. Specifically, within src/Base/Reader.cpp, the Base::XMLReader::XMLReader() constructor fails to disable external entity resolution and external DTD retrieval prior to parsing the Document.xml file contained inside a .FCStd archive. Because .FCStd files are uncompressed archive formats containing XML components, an attacker can manipulate the internal Document.xml structure to include malicious XML External Entity (XXE) definitions.\nThe attack flow proceeds in a step-by-step manner: First, an attacker crafts a malicious .FCStd archive containing a customized Document.xml file embedded with XML declarations referencing external entities. Second, the victim opens this crafted archive using an affected version of FreeCAD. Third, during the execution of the Document::restore() routine, the application invokes the vulnerable Base::XMLReader component to parse the Document.xml payload. Fourth, because external entity resolution remains enabled by default in the underlying Xerces parser, the parser processes the embedded URIs.\nDuring parsing, external entities referencing the file URI scheme force the application to read local files accessible to the user running the process. Alternatively, entities utilizing the http URI scheme initiate arbitrary server-side requests to attacker-controlled infrastructure. Once the external resource is resolved, the resulting content flows directly through the characters() callback mechanism. This behavior facilitates local file disclosure and potential server-side request forgery (SSRF) without requiring authentication, elevated privileges, or network exposure beyond the ability of the local application to process URIs during document restoration."
}