CVE-2025-1781: XEE
There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1781?
The severity of CVE-2025-1781 is considered to be high due to its potential for SSRF and unauthorized file access.
How do I fix CVE-2025-1781?
To fix CVE-2025-1781, upgrade the W3CSS Validator to version cssval-20250226 or later.
What kind of attack is associated with CVE-2025-1781?
CVE-2025-1781 is associated with an XML External Entity (XXE) attack that can lead to server-side request forgery (SSRF).
Can CVE-2025-1781 allow access to local files?
Yes, CVE-2025-1781 can be exploited to read arbitrary local files if an attacker gains access to exception messages.
Which versions of W3CSS Validator are affected by CVE-2025-1781?
W3CSS Validator versions prior to cssval-20250226 are affected by CVE-2025-1781.