Executive brief
YaCy Search Server is a peer-to-peer web search engine used to index and search documents. An attacker can publish malicious documents (SVG, FreeMind, or OpenSearch format) containing XML external entity declarations that cause the crawler to read and expose sensitive files from the server's filesystem into the searchable index, potentially revealing confidential information to unauthorized users.
Technical details
The vulnerability is an XML external entity (XXE) injection flaw in the SVG, FreeMind, and OpenSearch parsers in YaCy Search Server through version 1.941. These parsers fail to disable external entity resolution, allowing attackers to craft malicious documents with DOCTYPE declarations containing SYSTEM entities that reference local files. When the crawler processes these documents, it resolves the external entities and includes the file contents in the index. The attack requires publishing or hosting a malicious document that the YaCy crawler will process, but no authentication or special privileges are required. A patch disabling external entity resolution in the affected parsers should be applied.
Affected products
- YaCy Search Server through 1.941
Timeline
- 2026-08-31: disclosed