Executive Summary

CVE-2026-3511 is an Improper Restriction of XML External Entity Reference vulnerability found in the XMLUtils.java component of the Slovensko.Digital Autogram application. This vulnerability allows a remote unauthenticated attacker to perform Server Side Request Forgery (SSRF) attacks and gain unauthorized access to local files on the filesystem where the vulnerable application is running.

Exploitation requires the victim to visit a specially crafted website that sends a request containing a malicious XML document to the /sign endpoint of the local HTTP server run by the application. The vulnerability arises because the XML processing does not fully disable external entity references, allowing attackers to read local files by exploiting XML External Entity (XXE) features.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to remotely execute SSRF attacks and access sensitive local files without authentication. This unauthorized access could lead to exposure of confidential information stored on the local filesystem.

Since the attack requires the victim to visit a malicious website, it leverages social engineering to trigger the exploit. Successful exploitation compromises confidentiality but does not affect integrity or availability according to the CVSS score.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves an XML External Entity (XXE) attack vector in the XMLUtils.java component of the Autogram application, which can be exploited when a specially crafted XML document is sent to the /sign endpoint of the local HTTP server.

Detection would involve monitoring for unusual or unexpected XML payloads targeting the /sign endpoint on the local HTTP server of the Autogram application.

Since the application runs a local HTTP server, network detection might be limited to local traffic analysis or host-based monitoring.

Specific commands are not provided in the available resources or context.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Autogram application to version 2.7.2 or later, which includes a security patch that hardens XML utilities to prevent this XXE vulnerability.

This update was released promptly after the vulnerability was responsibly disclosed and addresses the incomplete mitigation of external entities in XML processing.

Users are strongly advised to apply this update to ensure protection against the identified security issue.

Useful 0 Not Useful 0