Datavane TIS CVE-2026-69101

Exploitation requires a valid authenticated session with at least low-privilege user access to the Datavane TIS application, consistent with the CVSS 4.0 PR:L metric. The attacker must be able to reach the TIS web interface over the network and submit a crafted POST request to the doEditWorkflow (edit_workflow action) endpoint with a malicious taskScript XML payload. For out-of-band exfiltration, the TIS server must have outbound network connectivity to attacker-controlled infrastructure - blocking egress would prevent OOB data exfiltration but may not prevent in-band or error-based file disclosure. Exploitation is limited to files readable by the OS-level user account running the TIS process; root or system-level files unreadable by that account are not directly accessible. No special non-default configuration is required beyond having the doEditWorkflow endpoint functional, which is standard TIS operation.

The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-accessible, low-complexity attack requiring only a valid authenticated session - no elevated privileges are needed. The dual high-confidentiality impact (VC:H on the vulnerable system and SC:H on subsequent systems) accurately reflects the attacker's ability to read sensitive local files and pivot via SSRF to internal services. No KEV listing exists and no POC has been independently confirmed, so this is not a confirmed actively-exploited vulnerability; however, the public patch diff and VulnCheck advisory provide sufficient technical detail that a skilled attacker could reconstruct the exploit. XXE-to-SSRF chains are a well-understood, low-skill technique, reducing effective complexity. EPSS data was not provided in input. The principal limiting factor is the authentication requirement - the attack surface is restricted to users with valid TIS credentials, which meaningfully narrows the realistic attacker pool compared to unauthenticated exposures.

An authenticated TIS user submits a taskScript payload to the doEditWorkflow endpoint containing an XML document with an external DTD reference pointing to an attacker-controlled HTTP server; the reference includes an entity that reads a local file such as a Derby database credential file using file://. The TIS server's DocumentBuilderFactory resolves the external entity, issues an outbound HTTP request carrying the file contents to the attacker's listener, completing the exfiltration without requiring any interaction from other users or elevated privileges beyond a standard TIS account. No public exploit code has been identified, but the technique is a standard XXE-OOB exfiltration pattern well-documented in public research.