Open-source package vulnerability · Maven
CVE-2025-65482: XDocReport affected by an XML External Entity (XXE) vulnerability
criticalCVSS 3.1 9.8GHSA-7jc7-g598-2p64
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
Published Jan 20, 2026 · Updated Jan 21, 2026
Affected packages
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document
- Ecosystem
- Maven
- Affected
- >= 0.9.2, < 2.0.4
- Fixed in
- 2.0.4
- Check
mvn dependency:tree -Dincludes=fr.opensagres.xdocreport:fr.opensagres.xdocreport.document
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-65482
- https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing
- https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-
- https://github.com/opensagres/xdocreport
- https://hackmd.io/@cuongnh/r1B7B8fJ-g
- https://hackmd.io/@cuongnh/rkJPCgSy-l
- https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332
- https://github.com/advisories/GHSA-7jc7-g598-2p64
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology