EUVD-2026-38152
GHSA-x2fm-rmw7-73v2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable import endpoint with no complexity barriers; PR:L because authentication is confirmed required; S:U as subsequent-system impact is assessed absent; C/I/A:L reflecting limited but real file-read and SSRF potential.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the component XML Parser. This manipulation causes xml external entity reference. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
XML External Entity (XXE) injection in zhilink ADP Application Developer Platform 1.0.0 enables authenticated remote attackers to manipulate the XML parser at the /adpweb/a/base/barcodeDetail/import endpoint, potentially exposing local files or facilitating server-side request forgery against internal infrastructure. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege exploitation with a publicly disclosed proof-of-concept published on Feishu. The vendor did not respond to pre-disclosure contact, leaving no official patch available at time of analysis.
Technical ContextAI
CWE-611 (Improper Restriction of XML External Entity Reference) describes a parser that processes externally supplied XML without disabling DOCTYPE declarations or external entity resolution. The vulnerable component is the XML parser backing the barcode import functionality at /adpweb/a/base/barcodeDetail/import within the zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台. The CPE string (cpe:2.3:a:zhilink_智互联(深圳)科技有限公司:adp_application_developer_platform_应用开发者平台:*:*:*:*:*:*:*:*) covers version 1.0.0 as confirmed by EUVD-2026-38152. Classic XXE payloads can reference file:// URIs for local file disclosure or http:// URIs to pivot to internal network resources the server can reach (SSRF). The CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:N) indicate the reporter assessed no direct cross-system scope change, though SSRF pivoting is an inherent XXE side effect.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to pre-disclosure contact. As a primary compensating control, restrict authenticated access to the /adpweb/a/base/barcodeDetail/import endpoint via WAF rules or reverse-proxy ACLs, limiting it to only those user roles that legitimately require barcode import functionality - this reduces the exploitable attack surface without disabling the broader application. At the XML parser layer, if source access is available, configure the XML parser to disable DOCTYPE declarations and external entity resolution (e.g., setting FEATURE_SECURE_PROCESSING or equivalent parser flags to true); this directly eliminates the CWE-611 root cause but requires application-level access and redeployment. Additionally, apply network egress filtering on the server hosting the platform to block outbound connections to arbitrary internal RFC-1918 addresses and file URIs, mitigating SSRF pivoting risk inherent to XXE. Monitor VulDB advisory https://vuldb.com/vuln/372530 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-12788 for any future vendor patch release.
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been rated a
Unsafe deserialization in zhilink ADP Application Developer Platform 1.0.0 exposes the testConnection endpoint to remote
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as cr
A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified
Share
External POC / Exploit Code
Leaving vuln.today