OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LOpenremote
APPOpenremote< 1.22.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SSRFXXE
CWE
Powiązane podatności
CVE-2026-39842CRITICAL9.9PL ✓ten sam produkt
RCE przez injection wyrażeń w silniku reguł OpenRemote (IoT)
CVE-2022-31860CRITICAL9.8ten sam produkt
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted G...
CVE-2026-41166HIGH7.0ten sam produkt
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin...