Executive brief
Agorum core open, an enterprise content management system used for document management and workflow automation, is vulnerable to a security flaw in its XML processing. An attacker can exploit this to remotely access sensitive files from the server or internal network without needing a password. This could lead to the exposure of confidential system information or corporate data, potentially compromising the entire document management platform.
Technical details
An XML External Entity (XXE) vulnerability (CWE-611) exists in Agorum core open due to improper restriction of XML external entity references. The vulnerability is primarily reachable via the RSSReader endpoint in the desk4web submodule, where an unauthenticated attacker can provide a crafted URL in the 'feed' parameter to trigger the loading of external DTDs and exfiltrate local files (e.g., /etc/hostname). Additionally, the Agorum Explorer and Desk4Web components are affected; while the UI restricts XML execution to administrators, low-privileged users can bypass these restrictions by manually crafting API requests to the 'filingAssistant' or by appending 'parseFile' parameters to upload requests. The vendor has released versions 11.9.2 and 11.10.1 to address these issues.
Affected products
- agorum Software GmbH Agorum core open 11.9.1.3-1857, 11.9.2, 11.10.1
Timeline
- 2025-05-05: disclosed: First contact with vendor
- 2025-05-30: patched: Vendor released versions 11.9.2 and 11.10.1
- 2025-06-16: advisory: Initial advisory published by usd HeroLab
- 2025-07-18: advisory: CVE-2025-52162 published to NVD