CVE-2016-9180

Critical

Published: 22/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In the perl-XML-Twig module, the `expand_external_ents` option, which is supposed to control external entity expansion, does not work correctly. External entities are always expanded, regardless of the option's setting.

Risk Assessment

Organizations may be vulnerable to XML External Entity (XXE) attacks, which could lead to the disclosure of sensitive data or attacks on internal systems.

Recommendation

It is recommended to avoid using this option in applications utilizing perl-XML-Twig and to monitor and update components to minimize risk.

Original NVD description (English source)

perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.