EUVD-2026-56933Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Victim must actively open a crafted local file (AV:L, UI:R); no privileges required; C:H for local file read, I:L for SSRF potential.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
AnalysisAI
XML External Entity (XXE) injection in FreeCAD prior to 1.1.2 allows an attacker who can deliver a crafted .FCStd archive to a user to read arbitrary local files via the file:// URI scheme or trigger server-side requests via the http:// URI scheme when the victim opens the file. The Xerces-C++ SAX2 XMLReader in src/Base/Reader.cpp was instantiated without disabling external entity resolution or external DTD loading, meaning Document.xml embedded inside a .FCStd archive is parsed with full entity expansion enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a crafted .FCStd archive file created by the attacker - CVSS UI:R confirms this user interaction is mandatory and passive exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) scores 6.1 (Medium), which is consistent with the actual risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a .FCStd archive whose Document.xml defines an external XML entity referencing a sensitive local file (e.g., file:///home/victim/.ssh/id_rsa on Linux or file:///C:/Users/victim/AppData/Roaming/credential-store on Windows) and a second entity whose resolved value is exfiltrated via an HTTP request to an attacker-controlled server. The attacker distributes the file through a phishing email, engineering forum, or file-sharing platform targeting FreeCAD users. … |
| Remediation | Upgrade FreeCAD to version 1.1.2 or later, confirmed available at https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today