CVE-2024-13971CWE-611

Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro

High · published April 30, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/V:C
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-04-30T12:11Z
EPSS history
Timeline
  • 30 APR 12:11Z
    Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro
    cvelistv5