CVE-2020-26259: XStream Arbitrary File Deletion Vulnerability
Summary
CVE-2020-26259: XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. Affects com.thoughtworks.xstream:xstream versions < 1.4.15. Fixed in 1.4.15. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2020-26259 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is an open-source Java library that allows for the serialization and deserialization of Java objects to XML and back. It is commonly used in various Java applications and frameworks. However, XStream versions 1.4.14 and below are vulnerable to an Arbitrary File Deletion vulnerability. This vulnerability allows a remote attacker to delete arbitrary files on the host system by manipulating the processed input stream.
Vulnerability Detail
The vulnerability arises due to a lack of proper input validation in XStream's unmarshalling process. By manipulating the input stream, an attacker can trick XStream into deleting files on the host system. This can lead to unauthorized access, data loss, or disruption of services. The vulnerability has a CVSS score of 6.8, indicating a moderate severity level.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.4.15 is not feasible, there are workarounds available depending on the version of XStream in use:
- For XStream 1.4.14, add the following lines to the setup code:
xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });
- For XStream 1.4.14 to 1.4.13, add the following lines to the setup code:
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });
-
For XStream 1.4.12 to 1.4.7, it is recommended to set up a custom blacklist and deny certain types. Please refer to the XStream documentation for more details.
-
For XStream 1.4.6 or below, register a custom converter to prevent the unmarshalling of critical types. Please refer to the XStream documentation for the complete code example.
Conclusion
The XStream Arbitrary File Deletion vulnerability poses a moderate risk to applications using XStream versions 1.4.14 and below. To mitigate this vulnerability, it is recommended to upgrade to version 1.4.15 or apply the provided workarounds. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is an open-source Java library used for serialization and deserialization of Java objects to XML and vice versa.
The vulnerability allows a remote attacker to delete arbitrary files on the host system, potentially leading to unauthorized access, data loss, or disruption of services.
To fix the vulnerability, it is recommended to upgrade to at least version 1.4.15 of XStream. Alternatively, you can apply the provided workarounds depending on your XStream version.
There are no known exploits for this vulnerability at the moment. However, it is crucial to apply the necessary fixes or workarounds to mitigate the risk.
For more information, you can refer to the XStream GitHub repository or the XStream Google Group. Additionally, you can use Vulert's playground to check if your application is affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
