CVE-2026-108086

Deferred Deferred - Pending Action

XML Entity Expansion Flaw in Apache Cocoon

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Apache Software Foundation

Description

** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-108086

EUVD

EUVD-2026-104911

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Cocoon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-776	The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XEE) flaw in Apache Cocoon, specifically in the fp: form processor. It allows improper recursive entity references in DTDs, which could lead to Server-Side Request Forgery (SSRF) and expose server files to untrusted external systems.

Detection Guidance

Since Apache Cocoon is no longer supported, detection involves checking if the software is installed and exposed. Inspect server configurations for Apache Cocoon instances and verify if the fp: form processor is enabled. No specific commands are provided as the project is retired.

Impact Analysis

The vulnerability could allow attackers to access sensitive files on the server or perform unauthorized actions via SSRF. Since Apache Cocoon is no longer supported, there is no official fix available.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy) by exposing files to untrusted external systems through SSRF.

Mitigation Strategies

Immediately restrict access to the Apache Cocoon instance to trusted users only. Consider migrating to an alternative solution as the project is no longer supported and no fixes will be released.

Hi! I’m here to help you understand CVE-2026-108086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...