EUVD-2026-32047
GHSA-p37q-jm8v-rgqf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
External XML entity resolution in Hitachi Vantara Pentaho Data Integration & Analytics lets an authenticated, low-privileged attacker submit crafted XML that the application's parser resolves, disclosing sensitive local files and enabling server-side request forgery against internal systems. All releases before 10.2.0.7 are affected, as are 11.x branches before 11.0.0.0, explicitly including the 9.3.x and 8.3.x lines. There is no public exploit identified at time of analysis, and the EPSS exploitation probability is very low (0.03%, 8th percentile).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Pentaho Data Integration And Analytics gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (HITVAN) · only source for this CVE.
CVSS VectorVendor: HITVAN
Lifecycle Timeline
1DescriptionCVE.org
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Executive ViewAI
Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.7 and 11.0.0.0 expose organizations to data exfiltration and internal network reconnaissance through XML processing vulnerabilities exploitable by authenticated users. Organizations running Pentaho with standard user populations face potential disclosure of sensitive configuration data and system files, with secondary risk of lateral movement to backend systems. Current exploitation probability is minimal (0.03% EPSS), creating immediate opportunity to patch.
Within 24 hours: Inventory all Pentaho Data Integration & Analytics deployments and document affected versions (prior to 10.2.0.7, 11.0.0.0, and all 9.3.x and 8.3.x releases). Within 7 days: Patch all instances-upgrade to Pentaho 10.2.0.7+, 11.0.0.0+, or retire/isolate end-of-life versions. Within 30 days: Verify successful patch deployment across all systems and audit data access logs for any unauthorized file access attempts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restr
Script execution in Hitachi Vantara Pentaho Data Integration & Analytics allows an authenticated data-source administrat
Missing ACL enforcement on Hitachi Vantara Pentaho Data Integration & Analytics API endpoints allows authenticated low-p
Plaintext credential exposure in Hitachi Vantara Pentaho Data Integration & Analytics allows authenticated network users
Exploit-DB