CVE-2026-69101: Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the editworkflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datavane TISto a version that resolves this vulnerability.Fixed in 5.0.0Patch XXE Injection via doEditWorkflow Endpoint - Configuration
Harden the XML parser used by the doEditWorkflow endpoint so that DocumentBuilderFactory does not allow external entities and does not load DTDs, preventing XXE-based outbound HTTP requests and out-of-band file exfiltration.
doEditWorkflow XML parsing DocumentBuilderFactory external entities / DTD loading = disable - Compensating control
Block outbound HTTP/HTTPS from the TIS server to prevent server-side request forgery (SSRF) caused by XXE payloads from reaching attacker-controlled infrastructure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69101?
The severity of CVE-2026-69101 is high with a score of 7.7.
How do I fix CVE-2026-69101?
To fix CVE-2026-69101, update Datavane TIS to the latest version that addresses the XXE injection vulnerability.
What type of vulnerability is CVE-2026-69101?
CVE-2026-69101 is an XML external entity (XXE) injection vulnerability.
What is affected by CVE-2026-69101?
CVE-2026-69101 affects Datavane TIS version 5.0.0.
What can attackers do with CVE-2026-69101?
Attackers can perform server-side request forgery and out-of-band file exfiltration using a crafted taskScript payload.