Apache Cocoon XEE flaw can enable SSRF and file disclosure
Original title: CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
Arnout Engelen reported a moderate XML entity expansion flaw in Apache Cocoon. Improper limits on recursive entity references in DTDs, in the fp form processor, could lead to server-side request forgery and expose server files to an untrusted external system. All versions are affected. The project was already retired and unsupported when the CVE was assigned.
Unconfirmed: The mailing-list post is truncated and does not state whether the flaw is exploited.
- The listed severity is moderate.
- Apache Cocoon is affected in all versions.
- The project was unsupported when the issue was assigned.
- The posted description is truncated after noting the retirement.
Impact: SSRF and disclosure of files from the server
| Product | Affected |
|---|---|
| Apache Cocoon | all versions |
- 1.Treat Apache Cocoon as retired; no fixed version is stated.
- CVEs
- CVE-2026-108086
- Vendors
- Apache
- Products
- Apache Cocoon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108086 | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon | 7.5 | — |
From the original article
Posted by Arnout Engelen on Oct 20 Severity: moderate Affected versions: - Apache Cocoon: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.