Executive brief
RESTEasy is a Java framework for building RESTful web services. This vulnerability allows unauthenticated attackers to read arbitrary files from the server by sending specially crafted XML requests to endpoints that process XML input. An attacker can extract sensitive files like configuration files or credentials, potentially compromising the entire application and underlying systems.
Technical details
This is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider.writeTo() method. The vulnerable component creates a SAXParser without disabling external entity resolution, allowing attackers to send DOCTYPE declarations with external entity references in XML request bodies. When the server processes XML with Source or StreamSource return types, it resolves the external entity and includes file contents in the HTTP response. The attack requires no authentication and can be triggered over the network against any endpoint accepting application/xml content-type.
Affected products
- Red Hat RESTEasy
Timeline
- 2026-08-31: disclosed