Executive brief
4D Server, a database and application server used to power desktop and mobile business applications, contains a vulnerability in how it handles web service requests. An unauthenticated attacker can exploit this to read sensitive files from the server or its connected network storage. Additionally, attackers can use the server as a proxy to probe or attack other internal systems that are not normally accessible from the internet.
Technical details
An XML External Entity (XXE) vulnerability exists in the SOAP endpoints (specifically /4DSOAP) of 4D Server due to improper restriction of XML external entity references (CWE-611). Remote, unauthenticated attackers can send specially crafted XML payloads to trigger the vulnerability. Exploitation can be achieved through error-based or out-of-band exfiltration techniques, even if 'Reject SOAP-Requests' is enabled in the server GUI. This allows for arbitrary file disclosure from the local filesystem and adjacent network shares, as well as Server-Side Request Forgery (SSRF) via HTTP GET requests to internal or external services. The vulnerability was confirmed in version 20 R3 and is reported to affect subsequent releases in the v20 branch.
Affected products
- 4D 4D Server v20 R3, v20 R4, v20 R6
Timeline
- 2026-04-29: advisory: Initial advisory released by SCHUTZWERK
- 2026-04-30: disclosed: CVE published to NVD