CVE-2026-69101
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Datavane TIS v5.0.0 contains an XML External Entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration. The vulnerability arises from processing XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document with an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files, including configuration files and Derby database credentials.
Risk Assessment
An authenticated attacker can access sensitive data such as configuration files and database credentials, and use the server to attack other systems (SSRF). This can lead to confidentiality and integrity breaches.
Recommendation
Upgrade Datavane TIS to a patched version or apply mitigations such as disabling external entities and DTD in DocumentBuilderFactory. Also restrict access to the doEditWorkflow endpoint.
Original NVD description (English source)
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.