EUVD-2026-70521
GHSA-pjc3-pxrj-h263
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file delivery with mandatory examiner interaction (UI:R); attacker needs no system privileges (PR:N); only confidentiality is impacted via arbitrary file read.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.
AnalysisAI
XML External Entity (XXE) injection in Exterro FTK Imager before 8.3 allows an attacker to read arbitrary files from a forensic examiner's workstation by embedding malicious entity references and XSLT scripts within a crafted UFDR evidence archive. When an examiner previews the weaponized archive, the XML parser resolves file:// URIs and executes msxsl:script within an attacker-controlled stylesheet, exfiltrating file contents to an external endpoint via a generated image URL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open or preview a crafted UFDR ZIP file in FTK Imager running a version prior to 8.3 - user interaction is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N accurately reflects the realistic attack surface: local file delivery and examiner interaction are required, which caps severity below network-exploitable flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Exterro FTK Imager 8.3 or later, available from the vendor at https://www.exterro.com/ftk-downloads/ftk-imager-8-3; the release notes at the CloudFront URL confirm this version addresses the XXE issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today