2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47293

CVE-2025-47293: PowSyBl Core XML Reader allows XXE and SSRF

Impact

What kind of vulnerability is it? Who is impacted? In certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels.

Am I impacted?

You are vulnerable if you allow untrusted users to import untrusted CGMES or XIIDM network files.

Patches

com.powsybl:powsybl-commons:6.7.2 and higher

References

powsybl-core v6.7.2

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47293

CVE-2025-47293:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.powsybl:powsybl-commons	maven	<= 6.7.1	6.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-47293 / GHSA-qpj9-qcwx-8jv2) is an XML External Entity (XXE) and Server-Side Request Forgery (SSRF) issue in PowSyBl Core, specifically within the com.powsybl.commons.xml.XmlReader class, though the underlying cause affected other XML parsing locations as well. The root cause was the use of XMLInputFactory (and DocumentBuilderFactory in some cases) with default configurations, which do not disable features that allow XXE and SSRF, such as processing of external DTDs and external general entities.

The XmlReader constructor (com.powsybl.commons.xml.XmlReader.<init>) would take an InputStream and create an XMLStreamReader using these insecure default settings. When methods like readContent(), readString(), or readAttribute() were subsequently called on this XmlReader instance to parse XML elements or attributes, they would use the insecurely configured XMLStreamReader. If the input XML contained malicious XXE/SSRF payloads (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd"> ... <data>&xxe;</data>), these methods would trigger the resolution of the external entities, leading to unauthorized file access or network requests.

The patch mitigates this by ensuring that all XMLInputFactory and DocumentBuilderFactory instances are created with secure configurations that disable DTD processing, external entity resolution, and access to external schemas/stylesheets. This is achieved by introducing and using centralized utility methods (XmlUtil.getXMLInputFactory() and XmlUtil.getDocumentBuilderFactory()) that enforce these secure settings. The identified vulnerable functions are the constructor of XmlReader that sets up the insecure parser with potentially malicious input, and its methods that subsequently trigger the parsing of malicious entities.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

2.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-47293: PowSyBl Core XML Reader allows XXE and SSRF

Impact

Am I impacted?

Patches

References

CVE-2025-47293:

2.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-47293: PowSyBl Core XML Reader allows XXE and SSRF

Impact

Am I impacted?

Patches

References

2.7

2.7

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI