EUVD-2026-68466
GHSA-7qrf-6jm7-8f89
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Crawler fetches attacker documents automatically (AV:N, PR:N, UI:N); impact is confidentiality only via local file read, with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.
AnalysisAI
XML external entity injection across three document parsers in YaCy Search Server through version 1.941 enables unauthenticated network attackers to exfiltrate arbitrary local file contents via the search crawler. When the YaCy crawler fetches attacker-controlled SVG, FreeMind, or OpenSearch XML documents containing malicious DOCTYPE SYSTEM entity declarations, the unprotected SAX parsers resolve those entities and write the referenced file contents directly into the searchable index. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the YaCy crawler to be active and to fetch an attacker-controlled document in one of three specific formats: SVG, FreeMind (.mm), or OpenSearch description XML. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) characterizes this as a remotely exploitable, high-severity confidentiality flaw requiring no authentication or interaction on the attacker's side. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit 3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44 at https://github.com/yacy/yacy_search_server/commit/3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44, which adds SAXParserFactory hardening to all three affected parsers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of YaCy Search Server version 1.941 or earlier in your environment and restrict the crawler from processing untrusted external document sources (SVG, FreeMind, OpenSearch XML) by limiting crawl scope to internal, validated content only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today