{"id":"CVE-2026-73235","summary":"FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser","details":"FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.","aliases":["GHSA-cp6c-87x9-xf49"],"modified":"2026-08-14T08:08:29.655375Z","published":"2026-08-11T19:43:49.042Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73235.json"},"references":[{"type":"WEB","url":"https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73235.json"},{"type":"ADVISORY","url":"https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73235"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/pull/31271"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/pull/31280"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freecad/freecad","events":[{"introduced":"0"},{"fixed":"7d1b8f5806db578db99feb348e55a6b0eaff7c73"},{"fixed":"d98eaf1f194400d8a8886fe6780c54f5c68ea2c3"},{"fixed":"6c24c1ac45f312fc6b604a076ea4cb0664d0c5ca"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.1.2"}]}}],"versions":["weekly-2026.07.09","weekly-2026.07.08","weekly-2026.07.01","weekly-2026.06.24","weekly-2026.06.20","weekly-2026.06.17","weekly-2026.06.10","weekly-2026.06.03","weekly-2026.05.27","weekly-2026.05.20","weekly-2026.05.13","weekly-2026.05.06","weekly-2026.04.29","weekly-2026.04.22","1.1.1","weekly-2026.04.15","weekly-2026.04.08","weekly-2026.04.01","1.1.0","weekly-2026.03.25","weekly-2026.03.19","weekly-2026.03.18","weekly-2026.03.11","weekly-2026.03.04","weekly-2026.02.25","1.1rc3","weekly-2026.02.18","weekly-2026.02.11","weekly-2026.02.04","weekly-2026.01.28","weekly-2026.01.21","weekly-2026.01.14","1.1rc2","weekly-2026.01.07","weekly-2025.12.31","weekly-2025.12.24","weekly-2025.12.17","weekly-2025.12.10","weekly-2025.12.03","1.1rc1","weekly-2025.11.26","weeklies","weekly-2025.11.20","weekly-2025.11.19","weekly-2025.11.12","weekly-2025.11.05","weekly-2025.11.02","weekly-2025.10.31","weekly-2025.10.29","weekly-2025.10.22","weekly-2025.10.15","weekly-2025.10.08","weekly-2025.10.01","weekly-2025.09.24","weekly-2025.09.17","weekly-2025.09.12","weekly-2025.09.11","weekly-2025.09.10","weekly-2025.09.03","weekly-2025.08.27","weekly-2025.08.20","weekly-2025.08.13","weekly-2025.08.07","weekly-2025.08.05","weekly-2025.08.04","weekly-2025.07.29","weekly-2025.07.28","weekly-2025.07.26","weekly-2025.07.25","weekly-2025.07.24","weekly-2025.07.21","weekly-2025.07.14","weekly-2025.07.07","weekly-2025.06.30","weekly-2025.06.23","weekly-2025.06.16","weekly-2025.06.09","weekly-2025.06.02","weekly-2025.05.26","weekly-2025.05.19","weekly-2025.05.13","weekly-2025.05.02","weekly-2025.05.06","weekly-2025.04.28","weekly-2025.04.21","0.21rc1","0.20","0.20beta1","0.19","0.18","0.17","0.16"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73235.json","vanir_signatures_modified":"2026-08-14T08:08:29Z","vanir_signatures":[{"source":"https://github.com/freecad/freecad/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73","target":{"file":"src/Base/Reader.cpp"},"deprecated":false,"digest":{"line_hashes":["192391342714035575527542319340750603475","60413679110899268520825100562493697013","288758999463628010938939678883803140342","30357786545414605670929374144036094542","4565082637380896305475685173435417880","221419062072677774603380900466228745720","162692722337514183333313701794322986869","141547071678858132968996437773565725910"],"threshold":0.9},"id":"CVE-2026-73235-3f435beb","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"214512959420007378493120163951683380237","length":880},"id":"CVE-2026-73235-4e9734ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3","target":{"file":"src/Base/Reader.cpp","function":"Base::XMLReader::XMLReader"}},{"deprecated":false,"digest":{"line_hashes":["192391342714035575527542319340750603475","60413679110899268520825100562493697013","288758999463628010938939678883803140342","30357786545414605670929374144036094542","4565082637380896305475685173435417880","221419062072677774603380900466228745720","162692722337514183333313701794322986869","141547071678858132968996437773565725910"],"threshold":0.9},"id":"CVE-2026-73235-d06260c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3","target":{"file":"src/Base/Reader.cpp"}},{"deprecated":false,"digest":{"function_hash":"214512959420007378493120163951683380237","length":880},"id":"CVE-2026-73235-f92b85ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73","target":{"file":"src/Base/Reader.cpp","function":"Base::XMLReader::XMLReader"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}]}