CVE-2026-82880: YaCy Search Server through 1.941 XML External Entity Injection via Parsers
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YaCy Search Serverto a version that resolves this vulnerability.Fixed in 1.941 - Configuration
Update YaCy Search Server so that the SVG, FreeMind, and OpenSearch parsers disable external entity resolution to prevent XML External Entity (XXE) injection from resolving SYSTEM entities to local files.
YaCy Search Server (SVG, FreeMind, OpenSearch parsers) external entity resolution (XML External Entity, XXE) = disabled
Event History
Frequently Asked Questions
What content paths expose a YaCy deployment to this issue?
The affected parsers handle SVG, FreeMind, and OpenSearch documents. A deployment is exposed when its crawler processes attacker-published documents of these types containing a DOCTYPE declaration with a SYSTEM entity.
What does an attacker need to exploit the vulnerability?
The attacker needs to publish a malicious SVG, FreeMind, or OpenSearch document that the YaCy crawler will parse. No authentication or user interaction is required according to the supplied CVSS vector.
What is the likely impact if exploitation succeeds?
The parser can resolve a SYSTEM entity that points to a local file, and the crawler can place that file's contents into the searchable index. This creates a high confidentiality impact; integrity and availability impacts are not indicated.
How can I check whether my instance may already have been affected?
Review indexed content for unexpected local-file data associated with crawled SVG, FreeMind, or OpenSearch documents, especially documents containing DOCTYPE declarations and SYSTEM entities. The provided information does not identify specific file paths or detection signatures.