critical9.8
CVE-2025-65482
XDocReport affected by an XML External Entity (XXE) vulnerability
Impact
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | fr.opensagres.xdocreport:fr.opensagres.xdocreport.document | >= 0.9.2, < 2.0.4 | 2.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensagres | Xdocreport | from 0.9.2 through 2.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing
- https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-
- https://github.com/opensagres/xdocreport
- https://hackmd.io/@cuongnh/r1B7B8fJ-g
- https://hackmd.io/@cuongnh/rkJPCgSy-l
- https://github.com/advisories/GHSA-7jc7-g598-2p64
- https://nvd.nist.gov/vuln/detail/CVE-2025-65482
- https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332