Yacy
Monthly
XML external entity injection across three document parsers in YaCy Search Server through version 1.941 enables unauthenticated network attackers to exfiltrate arbitrary local file contents via the search crawler. When the YaCy crawler fetches attacker-controlled SVG, FreeMind, or OpenSearch XML documents containing malicious DOCTYPE SYSTEM entity declarations, the unprotected SAX parsers resolve those entities and write the referenced file contents directly into the searchable index. No public exploit code or active exploitation has been confirmed at time of analysis, but a patch commit is available upstream and the XXE technique is trivially reproducible.
XML external entity injection across three document parsers in YaCy Search Server through version 1.941 enables unauthenticated network attackers to exfiltrate arbitrary local file contents via the search crawler. When the YaCy crawler fetches attacker-controlled SVG, FreeMind, or OpenSearch XML documents containing malicious DOCTYPE SYSTEM entity declarations, the unprotected SAX parsers resolve those entities and write the referenced file contents directly into the searchable index. No public exploit code or active exploitation has been confirmed at time of analysis, but a patch commit is available upstream and the XXE technique is trivially reproducible.