CVE-2026-73235

Received Received - Intake

Xerces XML External Entity Injection in FreeCAD

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73235

EUVD

EUVD-2026-56933

Affected Vendors & Products

Vendor	Product	Version / Range
freecad	freecad	1.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

CVE-2026-73235 is an XML External Entity (XXE) vulnerability in FreeCAD versions 1.1.1 and earlier. It occurs because the XMLReader in src/Base/Reader.cpp does not disable external entity resolution or DTD loading when parsing attacker-controlled Document.xml from a .FCStd archive. This allows malicious XML to read local files via file:// URIs or initiate server-side requests via http:// URIs.

Detection Guidance

To detect this vulnerability, check if your FreeCAD version is 1.1.1 or earlier. Inspect .FCStd files for malicious Document.xml content by examining XML parsing behavior. Use tools like grep or file inspection to verify if external entities are being processed in XML files.

Impact Analysis

An attacker could craft a malicious .FCStd file to read sensitive files on your system, such as SSH keys or configuration files, or perform Server-Side Request Forgery (SSRF) to access internal network services. This could lead to data breaches or unauthorized access to system resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable FreeCAD versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade FreeCAD to version 1.1.2 or later. Ensure the XMLReader in src/Base/Reader.cpp disables external entity resolution and DTD loading by setting XMLUni::fgXercesDisableDefaultEntityResolution to true and XMLUni::fgXercesLoadExternalDTD to false.

Hi! I’m here to help you understand CVE-2026-73235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70