CVE-2026-82880

YaCy Search Server releases through 1.941 are vulnerable to XML external entity injection (CWE-611) in their SVG, FreeMind, and OpenSearch parsers, which do not disable resolution of external XML entities. An attacker who causes a YaCy crawler to fetch a crafted document — an SVG image, FreeMind mind map, or OpenSearch description whose DOCTYPE declares SYSTEM entities pointing to local file paths — triggers the parser to resolve those entities and read files from the crawler host. The retrieved file contents are embedded in the parsed document and end up in the searchable index, letting the attacker retrieve sensitive local files via search (CVSS 4.0 8.7, network vector, no privileges or user interaction required, high confidentiality impact). Any operator running YaCy Search Server up to and including 1.941 is affected, particularly crawlers that index untrusted or attacker-influenced web content. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, so no exploitation has been confirmed.

What to do: Upgrade YaCy Search Server to a release newer than 1.941 as soon as a patched version is published (no fixed version is identified in the available data). Until then, restrict crawling of attacker-controlled or untrusted sources and avoid processing SVG, FreeMind, and OpenSearch documents from untrusted inputs, and check the search index for unexpected local file content (e.g., system files) that would indicate prior entity-injection abuse.