Description

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-09-05T05:17:13.407Z",
  "pubdate": "2026-09-05T05:17:13.407Z",
  "executiveSummary": "A vulnerability exists in libxml2 versions prior to 2.15.4 involving the improper propagation of parseFlags during XInclude processing. Specifically, the functions xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate critical security flags, such as XML_PARSE_NONET, to child XInclude operations.\nThis failure effectively bypasses intended security constraints, allowing the XML parser to access unauthorized external resources even when explicitly instructed to restrict network activity. The vulnerability impacts systems relying on libxml2 for XML document processing and XInclude resolution.\nThe risk implications are significant, as an attacker can potentially conduct XML External Entity (XXE) injection, Server-Side Request Forgery (SSRF), or Denial of Service (DoS) attacks by embedding malicious XInclude references in an XML document. Exploitation occurs when an attacker provides a maliciously crafted XML file to an application that processes it using the vulnerable functions, forcing the parser to fetch external resources that should have been prohibited. No specific authentication is required to trigger this vulnerability, as it is inherent to the document parsing process itself.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the XInclude processing engine within libxml2. When an application initiates document processing via xmlXIncludeProcess or xmlXIncludeProcessTree, the parser context holds defined parseFlags that govern security behavior—such as XML_PARSE_NONET, which disables network access during entity resolution.\nDuring the recursive traversal of the document structure to resolve XInclude elements, the parser fails to maintain or propagate these flags to the internal sub-processes responsible for fetching included documents. Consequently, when the parser encounters an 'xi:include' tag, it initiates a resource resolution request using a separate or derived context that lacks the security constraints set for the primary document parsing operation.\nThe attack flow proceeds as follows: An attacker submits an XML document containing an 'xi:include' element pointing to an arbitrary URL controlled by the attacker. Even if the application developer has correctly configured the parser with XML_PARSE_NONET to prevent SSRF or XXE, the vulnerability causes the underlying libxml2 components to ignore this restriction during the inclusion process.\nIf a custom resource loader is registered with the parser, it will be invoked to fetch the attacker-controlled resource. This leads to several potential exploitation vectors: First, XXE injection: the parser attempts to resolve and process the content of the external resource as part of the document, potentially exposing sensitive local file content or environment variables if the parser supports them. Second, SSRF: the parser makes outbound requests to internal or external services on behalf of the application, potentially interacting with services that expect requests only from the local host or a restricted network segment. Third, Denial of Service: the attacker points the XInclude directive to a slow-responding or infinite stream of data, causing the parsing process to hang and consuming system resources such as memory or thread availability, leading to service exhaustion.\nThe vulnerability affects libxml2 before version 2.15.4. Because the XInclude resolution is a fundamental part of the XML parsing pipeline, this issue is accessible whenever an application processes untrusted XML input that utilizes XInclude directives. It does not require specific user privileges to trigger, as the execution occurs within the context of the user or service running the XML-processing application."
}