CVE-2026-73235
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
FreeCAD prior to 1.1.2 uses the Xerces SAX2 XMLReader in Base::XMLReader, which does not disable default external entity resolution or external DTD loading. When opening a crafted .FCStd archive, external entities can read local files or initiate server-side requests, and resolved content can flow through the characters() callback.
Risk Assessment
The risk includes disclosure of local files or SSRF requests in the context of the user opening a malicious file, potentially leading to data leakage or further attacks.
Recommendation
Upgrade FreeCAD to version 1.1.2 or later, which includes a fix.
Original NVD description (English source)
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.