CVE-2026-71375
HighCVSS 7.4Summary
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. Allows an attacker to process malicious XML files, potentially leading to disclosure of sensitive data or unauthorized operations.
Risk Assessment
An attacker can exploit XXE to read files from the server, perform SSRF attacks, or access internal resources, potentially compromising data confidentiality and integrity.
Recommendation
Immediately update Cosminexus Component Container to a patched version, according to the list of affected versions provided in the vulnerability description.
Other vulnerabilities in Cosminexus Component Container
See all- CVE-2026-71377Critical
Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.
- CVE-2026-71376Critical
OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.
- CVE-2026-71374Critical
Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.
Original NVD description (English source)
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.