EUVD-2026-53300
GHSA-37rw-7gg6-5g3h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local delivery with required user interaction (UI:R); no privileges needed; read-only confidentiality impact (C:L); no integrity or availability consequence.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
1DescriptionCVE.org
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.
If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.
AnalysisAI
XML External Entity (XXE) injection in Eclipse Accessibility Tools Framework (ACTF) versions through 1.6.0 and miChecker through 3.1.0 allows a local attacker to exfiltrate files and probe internal network resources by supplying a maliciously crafted XML document to a user running an ACTF-based application. Exploitation requires user interaction - the victim must open or process the attacker-supplied XML - but no special privileges are required. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the limited, read-only confidentiality impact scoped to local and internal resources.
Technical ContextAI
CWE-611 (Improper Restriction of XML External Entity Reference) describes a class of vulnerabilities where an XML parser processes external entity declarations embedded in attacker-controlled XML input, causing the application to dereference URIs pointing to local filesystem paths (file://) or internal network endpoints (http://). Eclipse ACTF is a Java-based framework for building accessibility evaluation tools, and miChecker is its primary end-user application for checking web content accessibility. Both rely on XML processing for configuration, evaluation reports, or imported content. When the underlying XML parser is configured without disabling DTD processing or external entity resolution, any XML document accepted as input becomes an attack surface. The affected scope covers ACTF source releases through v20260630 and binary releases through version 1.6.0, and miChecker application builds through 3.1.0.
RemediationAI
Consult the official Eclipse ACTF vulnerability advisory at https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html for the vendor-released fixed versions; no exact patch version was independently confirmed in the available data at time of analysis. Until a patched release is applied, operators should configure the Java XML parser to disable DTD processing and external entity resolution by setting the javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING feature flag or by explicitly disabling DOCTYPE declarations on the DocumentBuilderFactory or SAXParserFactory - this is the most effective and targeted compensating control. As an operational workaround, restrict ACTF/miChecker users from opening XML files received from untrusted external parties. Network-layer egress filtering (blocking outbound HTTP/SMB from the workstation running miChecker) can reduce the exfiltration surface for SSRF-style XXE payloads but will not prevent local file disclosure. The Eclipse security tracking issue is documented at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151.
Share
External POC / Exploit Code
Leaving vuln.today