CVE Catalog
CVE-2026-16626
CriticalCVSS 9.3Summary
Jaspersoft JasperReports Server contains an unauthenticated XML External Entity (XXE) vulnerability. Affected versions are from 9.0.0 before HF-9 and from 10.0.0 before HF-10.
Risk Assessment
An unauthenticated attacker can exploit XXE to read files from the server, perform SSRF attacks, or other actions compromising confidentiality and integrity.
Recommendation
Apply the appropriate hotfixes HF-9 for version 9.0.0 or HF-10 for version 10.0.0.
Original NVD description (English source)
Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.