CVE-2026-73235: FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeCADto a version that resolves this vulnerability.Fixed in 1.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73235?
CVE-2026-73235 has a medium severity score of 6.1.
How do I fix CVE-2026-73235?
To fix CVE-2026-73235, upgrade to FreeCAD version 1.1.2 or later.
What type of vulnerability is CVE-2026-73235?
CVE-2026-73235 is an XXE (XML External Entity) vulnerability allowing for file read and SSRF.
What impact does CVE-2026-73235 have on my system?
CVE-2026-73235 can lead to information disclosure through unauthorized file reads.
In which software is CVE-2026-73235 found?
CVE-2026-73235 is found in FreeCAD versions prior to 1.1.2.