RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

RESTEasy permits XXE (XML eXternal Entity) attacks. If a RESTEasy endpoint is deployed, a user can submit a request containing an external XML entity. This XML entity will be resolved, allowing a remote attacker to read files in the context of the user running the application server. This flaw affects DOM Document, JAXB and Fast Infoset (FI) input.

Upstream bugs: https://issues.jboss.org/browse/RESTEASY-637 https://issues.jboss.org/browse/RESTEASY-647 https://issues.jboss.org/browse/RESTEASY-659