CVE-2025-65482: XDocReport XML External Entity (XXE) Vulnerability
Summary
CVE-2025-65482: XDocReport affected by an XML External Entity (XXE) vulnerability. Affects fr.opensagres.xdocreport:fr.opensagres.xdocreport.document versions >= 0.9.2, < 2.0.4. Fixed in 2.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XDocReport is an open-source library that allows developers to generate documents in various formats, including .docx, from templates. It is widely used in Java applications for document generation. The library provides features for manipulating document content and styles, making it a valuable tool for applications that require dynamic document creation. However, certain versions of XDocReport are vulnerable to an XML External Entity (XXE) attack, which can lead to severe security risks.
Vulnerability Detail
The XXE vulnerability in XDocReport versions 0.9.2 to 2.0.3 allows attackers to upload specially crafted .docx files that can execute arbitrary code on the server. This vulnerability arises from improper handling of XML input, enabling attackers to exploit the XML parser's capabilities to access sensitive files or execute malicious commands. The potential ramifications include unauthorized access to system resources, data breaches, and complete system compromise.
How To Fix
Minimum fixed version
2.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization for XML files before processing them. Additionally, disable external entity processing in your XML parser configuration to mitigate the risk of XXE attacks.
Conclusion
The XXE vulnerability in XDocReport poses significant security risks, allowing attackers to execute arbitrary code through crafted .docx files. It is crucial to update to the patched version 2.0.4 or later to mitigate these risks. Additionally, employing workarounds can help protect applications until an update can be applied.
See every vulnerability recorded for fr.opensagres.xdocreport:fr.opensagres.xdocreport.document →
FAQ
An XXE vulnerability occurs when an XML parser is tricked into processing external entities, which can lead to unauthorized access to files and services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Consequences can include data breaches, unauthorized access to sensitive information, and potential system compromise.
Yes, the vulnerability has been patched in version 2.0.4 of XDocReport. It is recommended to update to this version or later.
Implement input validation and disable external entity processing in your XML parser as a temporary workaround.
