XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

Summary

CVE	CVE-2020-26259
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-12-16 01:15:12 UTC
Updated	2026-10-07 19:17:17 UTC
Description	XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

Risk And Classification

Primary CVSS: v3.1 6.8 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS: 0.823920000 probability, percentile 0.996570000 (date 2026-10-07)

Problem Types: CWE-78 | CWE-78 CWE-78 OS Command Injection

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	6.8	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N`
3.1	[email protected]	Secondary	6.8	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N`
3.1	CNA	DECLARED	6.8	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N`
2.0	[email protected]	Primary	6.4		`AV:N/AC:L/Au:N/C:N/I:P/A:P`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Partial

AV:N/AC:L/Au:N/C:N/I:P/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Struts	All	All	All	All
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Fedoraproject	Fedora	34	All	All	All
Operating System	Fedoraproject	Fedora	35	All	All	All
Application	Xstream	Xstream	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	X-stream	Xstream	affected < 1.4.15	Not specified

References

Reference	Source	Link	Tags
December 2020 XStream Vulnerabilities in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling · Advisory · x-stream/xstream · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Mitigation, Third Party Advisory
XStream - CVE-2020-26259	af854a3a-2127-422b-91ae-364da2661108	x-stream.github.io	Exploit, Mitigation, Third Party Advisory
[SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
[SECURITY] [DLA 2507-1] libxstream-java security update	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org	Mailing List, Third Party Advisory
[SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
Pony Mail!	af854a3a-2127-422b-91ae-364da2661108	lists.apache.org	Issue Tracking, Mailing List
[SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
Debian -- Security Information -- DSA-4828-1 libxstream-java	af854a3a-2127-422b-91ae-364da2661108	www.debian.org	Third Party Advisory
[SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
Pony Mail!	MITRE	lists.apache.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

174824 SUSE Enterprise Linux Security update for SUSE Manager Server 4.1 (SUSE-SU-2021:0906-1)
198361 Ubuntu Security Notification for XStream vulnerabilities (USN-4943-1)
281980 Fedora Security Update for xstream (FEDORA-2021-d894ca87dc)
281981 Fedora Security Update for xstream (FEDORA-2021-fbad11014a)
375337 IBM Spectrum Control Multiple Vulnerability(6415993)
375827 XStream Arbitrary Code Execution And Multiple vulnerabilities
750401 OpenSUSE Security Update for xstream (openSUSE-SU-2021:0140-1)
980089 Java (maven) Security Update for com.thoughtworks.xstream:xstream (GHSA-jfvx-7wrx-43fh)