IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-20 16:16

MODIFIED

2026-01-20 16:16

EPSS (Prob. Exploit)

0.57%

Top 52.6%

DATA SOURCES:

NVD 🔗 2026-01-20 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7jc7-g598-2p64 CRITICAL

XDocReport affected by an XML External Entity (XXE) vulnerability

AFFECTED PACKAGES:

MAVEN / fr.opensagres.xdocreport:fr.opensagres.xdocreport.document

>= 0.9.2, < 2.0.4

Fixed in: 2.0.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

6 versions affected

ALIASES:

GHSA-7jc7-g598-2p64

> HISTORIQUE DES MODIFICATIONS

Première apparition

20/01/2026 16:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sha...

https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-

https://github.com/opensagres/xdocreport

https://hackmd.io/@cuongnh/r1B7B8fJ-g

https://hackmd.io/@cuongnh/rkJPCgSy-l