Executive brief
Apache CXF, a popular framework for building web services, contains a security flaw in its WS-Transfer module. This vulnerability could allow an attacker to read sensitive files from the server or conduct internal network scans by sending specially crafted XML data. Organizations using this library should update to the latest patched versions to prevent unauthorized data access.
Technical details
An XML External Entity (XXE) vulnerability exists in the Apache CXF WS-Transfer module (cxf-rt-ws-transfer) due to an insecurely configured XML parser. The parser fails to properly restrict the resolution of external entity references within incoming XML messages. A remote, unauthenticated attacker can exploit this by sending a malicious XML payload to a service endpoint using WS-Transfer, potentially leading to the disclosure of local files, server-side request forgery (SSRF), or denial-of-service. The issue is resolved in versions 4.2.1, 4.1.6, and 3.6.11.
Affected products
- Apache Software Foundation Apache CXF 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, all versions before 3.6.11
Timeline
- 2026-05-22: advisory: Initial disclosure by Apache Software Foundation
- 2026-05-22: patched: Fixes released in versions 4.2.1, 4.1.6, and 3.6.11