Description
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Remediation
References
https://github.com/alkacon/opencms-core/issues/725
https://github.com/alkacon/opencms-core/releases
Related Vulnerabilities
CVE-2023-37956 Vulnerability in maven package org.jenkins-ci.plugins:test-results-aggregator
CVE-2021-29506 Vulnerability in maven package com.graphhopper:graphhopper-nav
CVE-2021-3189 Vulnerability in npm package slashify
CVE-2016-10735 Vulnerability in maven package org.ow2.jonas:bootstrap
CVE-2021-41189 Vulnerability in maven package org.dspace:dspace-api