Executive brief
Spring Web Services is a framework used to build SOAP web services and process XML documents. The Jaxp13XPathTemplate component incorrectly parses untrusted XML using Java's default XML parser instead of Spring's hardened configuration, allowing attackers to exploit XML External Entity (XXE) vulnerabilities. An attacker who can submit malicious XML payloads to an application evaluating XPath expressions could read sensitive files or conduct denial-of-service attacks.
Technical details
The vulnerability exists in the Jaxp13XPathTemplate class, which evaluates XPath expressions against XML documents provided as StreamSource or SAXSource inputs. The vulnerable code path uses XPath.evaluate() with an InputSource, which internally invokes the JDK's default DocumentBuilderFactory without Spring's XXE-hardening configurations (external entity expansion disabled, DTD processing disabled, etc.). This allows an attacker submitting XML containing malicious DOCTYPE declarations and entity references to trigger XXE attacks. The attacker requires the ability to provide XML input to the XPath evaluation function; no authentication or elevated privileges are required. Successful exploitation enables arbitrary file read, SSRF, or denial-of-service. Patches are available: versions 5.0.2, 4.1.4, and later versions of 4.0.x and 3.1.x series include fixes that use Spring's hardened DocumentBuilderFactory utility and bypass unsafe InputSource-only parsing.
Affected products
- Spring spring-xml 5.0.0 to 5.0.1
- Spring spring-xml 4.1.0 to 4.1.3
- Spring spring-xml 4.0.0 to 4.0.18
- Spring spring-xml 3.1.0 to 3.1.8
Timeline
- 2026-06-11: disclosed: Published in GitHub Advisory Database
- 2026-06-09: patched: Fix committed to spring-projects/spring-ws (versions 5.0.2, 4.1.4 and later)