** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
"}],"value":"** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.\n\n\n\nThis issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-776","description":"CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T10:24:53.426Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/mt0h1cpjzps76nq6op7714rmnq6pbtht"}],"source":{"discovery":"UNKNOWN"},"tags":["unsupported-when-assigned"],"title":"Apache Cocoon: XEE could lead to SSRF and information disclosure","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-108086","datePublished":"2026-10-20T10:24:53.426Z","dateReserved":"2026-10-09T12:19:19.802Z","dateUpdated":"2026-10-20T18:09:54.081Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-20 11:17:16","lastModifiedDate":"2026-10-20 19:34:00","problem_types":["CWE-776","CWE-776 CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"108086","Ordinal":"1","Title":"Apache Cocoon: XEE could lead to SSRF and information disclosure","CVE":"CVE-2026-108086","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"108086","Ordinal":"1","NoteData":"** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.\n\n\n\nThis issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","Type":"Description","Title":"Apache Cocoon: XEE could lead to SSRF and information disclosure"}]}}}