CyberRota Analysis
AI-GeneratedYaCy Search Server versions up to 1.941 are vulnerable to an XML external entity injection flaw in their SVG, FreeMind, and OpenSearch parsers due to inadequate disabling of external entity resolution. This vulnerability allows attackers to craft malicious documents that can lead to the exfiltration of local file contents into the searchable index, potentially exposing sensitive information. Organizations using YaCy Search Server should prioritize addressing this issue to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.