CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Apache Cocoon instance to trusted users.
Event History
Frequently Asked Questions
Which deployments are exposed?
All Apache Cocoon versions are affected. The issue is in the fp: form processor, and the project is retired and unsupported.
What would an attacker need to exploit this?
An attacker would need access sufficient to cause the affected form processor to handle XML with recursive entity references. Successful exploitation could enable SSRF and expose server files to an untrusted external system.
Is a vendor fix available?
No fix is planned because Apache Cocoon is retired. Users are recommended to migrate to an alternative product.
What can be done if migration cannot happen immediately?
Restrict access to the Cocoon instance to trusted users. This reduces exposure to untrusted XML input reaching the affected form processor.