8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55471

CVE-2026-55471: HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55471

CVE-2026-55471:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ca.uhn.hapi.fhir:org.hl7.fhir.utilities	maven	<= 6.9.9	6.9.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic XML External Entity (XXE) injection (CWE-611) found in the org.hl7.fhir.utilities.XsltUtilities class. The methods named saxonTransform were insecurely instantiating a Saxon TransformerFactory without disabling features that process external entities. This oversight was present in all three overloads of the saxonTransform method, making them all vulnerable.

The patch, identified in commit 01ca2ecdefec9b33204d2495fe78af8c0dc52298, rectifies this by introducing a new helper method, org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedSaxonTransformerFactory(). This new method creates a TransformerFactory instance and explicitly disables external DTD and stylesheet access by setting the XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET attributes. The vulnerable saxonTransform methods were then updated to use this secure factory, thus closing the XXE vulnerability. Any application using these methods to process untrusted XML was at risk of information disclosure and SSRF.

Vulnerable functions

org.hl7.fhir.utilities.XsltUtilities.saxonTransform

org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/XsltUtilities.java

The `saxonTransform` methods (in all its overloaded forms) were vulnerable to XML External Entity (XXE) injection. They directly instantiated a `net.sf.saxon.TransformerFactoryImpl` without disabling the processing of external DTDs and stylesheets. This allowed an attacker to provide a specially crafted XML input, leading to the disclosure of local files or Server-Side Request Forgery (SSRF). The patch fixes this by replacing the insecure instantiation with a call to a new hardened factory method, `newXXEProtectedSaxonTransformerFactory`, which properly secures the XML transformer.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.