Description

Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-03T16:18:23.077Z",
  "pubdate": "2026-09-03T16:18:23.077Z",
  "executiveSummary": "A critical XML External Entity (XXE) injection vulnerability exists in Exterro FTK Imager versions prior to 8.3. This vulnerability allows remote, unauthenticated attackers to read arbitrary files from the host filesystem of an examiner analyzing digital evidence. The issue stems from insecure XML parsing configurations within the application when processing specific forensic image formats, specifically UFDR ZIP archives.\nBy crafting a malicious UFDR archive containing a manipulated Report.xml file with embedded external entity references and attacker-controlled XSLT stylesheets, an attacker can trigger unauthorized file disclosure. When an investigator previews or processes the malicious archive within FTK Imager, the underlying parser attempts to resolve external entities and executes XSLT instructions. This can lead to the unauthorized extraction of sensitive system files, configuration data, or credential stores from the examiner's workstation.\nBecause forensic workstations often handle highly sensitive data, the compromise of such systems represents a severe risk to the integrity of investigations and the confidentiality of proprietary or classified information. Exploitation requires user interaction to open or preview the malicious evidence file, but requires no prior privileges or authentication on the target system.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure configuration of the XML parser utilized by Exterro FTK Imager when parsing report data contained within Universal Forensic Data Recovery (UFDR) ZIP evidence archives. Specifically, the parser fails to disable external entity resolution and permits the processing of external eXtensible Stylesheet Language Transformations (XSLT). When an examiner imports or previews a compromised UFDR archive, the application extracts and processes the internal 'Report.xml' file.\nAn attacker can exploit this behavior by constructing a specialized 'Report.xml' that defines a malicious XML external entity pointing to a local file resource using the 'file://' protocol handler. Furthermore, the attacker embeds or references a malicious XSLT stylesheet within the XML structure. During the parsing phase, the vulnerable XML parser encounters the external entity reference and attempts to resolve it by reading the specified file from the host filesystem. Simultaneously, the parser processes the XSLT stylesheet. If the environment supports Microsoft's XML processor (MSXML), the attacker can leverage the 'msxsl:script' element within the stylesheet to execute script blocks during stylesheet compilation.\nThe attack flow executes through the following steps: First, the attacker creates a malicious UFDR ZIP archive containing a manipulated 'Report.xml' file that defines an external entity pointing to a sensitive local file and references an attacker-controlled XSLT stylesheet. Second, the forensic examiner loads the UFDR archive into Exterro FTK Imager. Third, as the application attempts to render or parse the report preview, the XML parser resolves the 'file://' URI, reading the targeted file's contents into memory. Fourth, the 'msxsl:script' block within the XSLT stylesheet executes, capturing the retrieved file contents and encoding them. Fifth, the script appends the encoded data to a dynamically generated image URL pointing to an attacker-controlled external endpoint. Finally, the application attempts to load the image URL, exfiltrating the file contents via the outbound request."
}