9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65482

CVE-2025-65482: XDocReport affected by an XML External Entity (XXE) vulnerability

An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65482

CVE-2025-65482:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document	maven	>= 0.9.2, < 2.0.4	2.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an XML External Entity (XXE) injection in the XDocReport library. The provided commit d9b90ae6c9489dc43f6427ec7b315cab34125332 directly addresses this issue. The patch modifies the preprocess method within the SAXXDocPreprocessor.java file. Before the patch, the XMLReader was instantiated without any protection against XXE, allowing a crafted .docx file to include external entities, leading to arbitrary code execution or information disclosure. The patch adds security features to the XMLReader to disable DTD loading and external entities, thus fixing the vulnerability. The vulnerable function is therefore fr.opensagres.xdocreport.document.preprocessor.sax.SAXXDocPreprocessor.preprocess as it is the entry point for processing the malicious XML content.

Vulnerable functions

fr.opensagres.xdocreport.document.preprocessor.sax.SAXXDocPreprocessor.preprocess

document/fr.opensagres.xdocreport.document/src/main/java/fr/opensagres/xdocreport/document/preprocessor/sax/SAXXDocPreprocessor.java

The `preprocess` method in `SAXXDocPreprocessor` was vulnerable to XXE because it created an `XMLReader` without disabling external entities. The patch mitigates this by setting the features `http://apache.org/xml/features/nonvalidating/load-external-dtd`, `http://xml.org/sax/features/external-general-entities`, and `http://xml.org/sax/features/external-parameter-entities` to `false`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.