GHSA-7jc7-g598-2p64

XDocReport affected by an XML External Entity (XXE) vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-65482

Packages

Ecosystem	Package	Affected	Fixed in
Maven	fr.opensagres.xdocreport:fr.opensagres.xdocreport.document	>= 0.9.2, < 2.0.4	2.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-65482 advisory
https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332 web
https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing web
https://github.com/AT190510-Cuong/CVE-2025-65482-XXE- web
https://github.com/opensagres/xdocreport package
https://hackmd.io/@cuongnh/r1B7B8fJ-g web
https://hackmd.io/@cuongnh/rkJPCgSy-l web