CVE-2026-61586
Description
A flaw was found in Copernik XML Factory. When an application enables XML Inclusions (XInclude) while using the stock Java Development Kit (JDK) parser, the library fails to restrict external resource resolution. A remote attacker can exploit this flaw by submitting crafted XML input containing malicious include references. Successful exploitation primarily results in information disclosure through the unauthorized reading of local files, and may also permit the attacker to reach internal network endpoints via server-side request forgery (SSRF).
Statement
This flaw is rated with an Important severity impact because unauthenticated remote attackers can potentially read arbitrary local files or trigger server-side request forgery (SSRF) against internal services. To be vulnerable, an application must explicitly enable XML inclusion processing while handling untrusted input on a runtime environment using the standard JDK parser without Apache Xerces. Under default conditions where XInclude remains unconfigured or where Xerces-based parsing implementations are deployed, applications are not exposed to this resource resolution weakness.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Technical Impact: Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
