Executive brief
HAPI FHIR is a Java library used to implement healthcare data standards for interoperability. A security flaw in its XML processing component allows an attacker to read sensitive local files or perform unauthorized network requests by providing a specially crafted XML document. This could lead to the exposure of confidential patient data or internal system information.
Technical details
The vulnerability exists in the `org.hl7.fhir.utilities.XsltUtilities` class, specifically within the `saxonTransform(...)` overloads. These methods instantiate a `net.sf.saxon.TransformerFactoryImpl` without disabling external DTDs or external stylesheets (missing `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` restrictions). An attacker who can influence the XML source, DTD, or stylesheet processed by these methods can trigger an XXE injection. This can be exploited for local file disclosure, blind XXE, or SSRF against internal network resources. The issue was resolved in version 6.9.10 by ensuring the Saxon factory is properly hardened.
Affected products
- hapifhir org.hl7.fhir.core < 6.9.10
Timeline
- 2026-06-12: patched: Version 6.9.10 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE published to NVD