CVE-2026-3511CWE-611

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to…

High · published March 19, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-03-19T11:25Z
EPSS history
Timeline
  • 19 MAR 11:25Z
    Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to…
    cvelistv5