CVE-2018-1259: Spring Data Commons XML External Entity Reference Restriction Bypass
Summary
CVE-2018-1259: Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML exte... Affects org.springframework.data:spring-data-commons across 2 version ranges.
>= 1.13.0, < 1.13.12
>= 2.0.0, < 2.0.7
Fixed in 1.13.12 or 2.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a library that provides a set of utilities and abstractions for working with data repositories in Spring applications. It is commonly used in combination with XMLBeam, a library for XML data binding. This vulnerability affects versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7 of Spring Data Commons when used with XMLBeam 1.4.14 or earlier versions.
Vulnerability Detail
The vulnerability arises from the improper restriction of XML external entity references in Spring Data Commons. The underlying library, XMLBeam, does not properly restrict the expansion of external references. This allows an unauthenticated remote attacker to exploit the vulnerability by supplying specially crafted request parameters to Spring Data's projection-based request payload binding. By doing so, the attacker can gain unauthorized access to arbitrary files on the system. This can lead to sensitive information disclosure or even remote code execution.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.13.0, < 1.13.121.13.12 -
>= 2.0.0, < 2.0.72.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a possible workaround is to disable XML external entity expansion in the application's XML parser configuration. This can be achieved by setting the appropriate properties or features in the XML parser implementation being used. Consult the documentation of the XML parser library for guidance on how to disable external entity expansion.
Conclusion
The vulnerability in Spring Data Commons and XMLBeam allows an unauthenticated remote attacker to bypass XML external entity reference restrictions and access arbitrary files on the system. It is crucial to upgrade to the fixed versions of the affected libraries to mitigate this vulnerability. If immediate upgrade is not possible, disabling XML external entity expansion in the XML parser configuration can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
Spring Data Commons is a library that provides utilities and abstractions for working with data repositories in Spring applications. It simplifies the implementation of data access layers and provides consistent APIs for interacting with different data sources.
XMLBeam is a library for XML data binding. It allows developers to map XML data to Java objects and provides convenient methods for querying and manipulating XML documents.
The vulnerability allows an attacker to access arbitrary files on the system by exploiting the XML external entity reference restriction bypass. This can lead to unauthorized disclosure of sensitive information or even remote code execution, depending on the specific circumstances.
No, only versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7 are affected. If you are using a different version, you are not vulnerable to this specific issue.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
