Skip to main content

Mustang CVE-2025-66372

LOW
Improper Restriction of XML External Entity Reference (CWE-611)
2025-11-28 cve@mitre.org
XXE
2.8
CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:24 vuln.today
CVE Published
Nov 28, 2025 - 04:16 nvd
LOW 2.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 maven packages depend on org.mustangproject:library (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.16.3.

DescriptionNVD

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

AnalysisAI

Mustang before 2.16.3 allows exfiltrating files via XXE attacks. Rated low severity (CVSS 2.8). No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Mustang before 2.16.3 allows exfiltrating files via XXE attacks. Version information: before 2.16.3.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

Share

CVE-2025-66372 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy