What is the CVSS score of CVE-2026-36765?

CVE-2026-36765 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SpringBlade are affected by CVE-2026-36765?

SpringBlade v4.8.0 contains an XML external entity injection vulnerability in the report designer endpoint that allows any authenticated user to execute arbitrary code and compromise system…

How to fix or mitigate CVE-2026-36765?

Within 24 hours: Inventory all SpringBlade deployments and identify instances running v4.8.0. Within 7 days: Immediately upgrade to SpringBlade v4.8.1 or later if available; if no patched version exists, restrict network access to the /designer/loadReport endpoint to authorized users only and disable XML external entity processing at the application or WAF level. Within 30 days: Conduct access review of all accounts with report designer privileges, implement enhanced logging on the /designer endpoint, and validate that no unauthorized access occurred during the vulnerability window.

SpringBlade CVE-2026-36765

EUVD-2026-26400 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-04-30 mitre

XXE RCE N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 18:22 vuln.today

CVSS changed

May 04, 2026 - 18:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 18:00 euvd

EUVD-2026-26400

Analysis Generated

Apr 30, 2026 - 18:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.

AnalysisAI

XML external entity injection in SpringBlade v4.8.0's /designer/loadReport endpoint enables authenticated attackers to execute arbitrary code remotely. The vulnerability requires low-privilege authentication (PR:L) but no other special conditions (AC:L, UI:N), allowing attackers with basic credentials to compromise confidentiality, integrity, and availability. EPSS probability is low (0.02%, 6th percentile) indicating minimal observed exploitation activity. No CISA KEV listing confirms this is not yet widely exploited in the wild, though a GitHub issue documents the flaw suggesting proof-of-concept details may exist.

Technical ContextAI

SpringBlade is a Java-based microservices development platform built on Spring Boot and Spring Cloud. The vulnerability stems from CWE-611 (Improper Restriction of XML External Entity Reference) in the report loading functionality. XXE attacks exploit weakly configured XML parsers that process external entity references, allowing attackers to read local files, perform server-side request forgery (SSRF), or achieve remote code execution when combined with specific processing contexts. The /designer/loadReport endpoint appears to accept XML input without properly disabling external entity processing in the underlying parser, typical of Java XML processors like DocumentBuilderFactory, SAXParserFactory, or XMLInputFactory when secure processing features are not enabled. The CPE data shows n/a placeholders indicating incomplete product identification in the NVD database, though the GitHub repository confirms SpringBlade as the affected product.

RemediationAI

Upgrade SpringBlade to a patched version that addresses GitHub issue #37, checking the project's release notes and commit history at https://github.com/chillzhuang/SpringBlade for fixes applied after v4.8.0. Upstream fix available (PR/commit); released patched version not independently confirmed from provided data. If immediate patching is not feasible, implement XML parser hardening by disabling external entity processing in all XML parsers: for DocumentBuilderFactory set feature 'http://apache.org/xml/features/disallow-doctype-decl' to true and 'http://xml.org/sax/features/external-general-entities' to false; for SAXParserFactory apply equivalent secure processing features. Restrict network access to /designer/* endpoints to trusted administrative IP ranges only via firewall rules or reverse proxy ACLs, noting this reduces designer functionality accessibility for remote administrators. Implement authentication strengthening with multi-factor authentication for designer interface access to raise the authentication barrier beyond PR:L. Monitor XML processing logs for suspicious entity declarations or external resource requests as detection mechanism, though this provides no prevention and adds operational overhead.