YaCy Search Server through 1.941 XML External Entity Injection via Parsers
Summary
| CVE | CVE-2026-82880 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-31 11:16:41 UTC |
| Updated | 2026-08-31 20:56:08 UTC |
| Description | YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-611 | CWE-611 Improper Restriction of XML External Entity Reference
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Yacy | Yacy Search Server | affected 1.941 custom | Not specified |
| CNA | Yacy | Yacy Search Server | unaffected 3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44 git | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/yacy/yacy_search_server/blob/Release_1.941/source/net/yacy/do... | [email protected] | github.com | |
| github.com/yacy/yacy_search_server/commit/3c3a307e8b7a0ebbc4d1e6b10898b5... | [email protected] | github.com | |
| github.com/yacy/yacy_search_server | [email protected] | github.com | |
| github.com/yacy/yacy_search_server/issues/818 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| github.com/yacy/yacy_search_server/blob/Release_1.941/source/net/yacy/do... | [email protected] | github.com | |
| www.vulncheck.com/advisories/yacy-search-server-through-1.941-xml-external-enti... | [email protected] | www.vulncheck.com | |
| github.com/yacy/yacy_search_server/blob/Release_1.941/source/net/yacy/do... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yu Sun (en)
There are currently no legacy QID mappings associated with this CVE.