CVE-2026-6807CWE-611

NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

Medium · published April 28, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to

trigger improper handling of XML input, which may result in unintended

exposure of sensitive information. The flaw stems from insufficient

hardening of the XML parsing process.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-04-28T17:41Z
EPSS history
Timeline
  • 28 APR 17:41Z
    NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
    cvelistv5