---
id: "CVE-2026-118468"
page: "https://infrastack.ai/live/CVE-2026-118468"
kind: "vulnerability"
aliases: ["CVE-2026-118468"]
title: "XML parsers resolve external entities in update manifests and network responses"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "xml"]
not_affected_if: []
published_at: "2026-11-09T12:16:37+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:28:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118468", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T12:28:38+00:00"}]
exploit_sources: []
---

# XML parsers resolve external entities in update manifests and network responses

Link for people: https://infrastack.ai/live/CVE-2026-118468 (this .md is for agents)

Some XML parsers read attacker-influenced update manifests or network responses with external entity resolution turned on. An attacker who can shape that XML could make the parser read local files or reach internal network addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118468
- 2026-11-09T12:28:38+00:00 analyst — Could not identify product: NVD page returned no content via WebFetch (empty shell), web-cli out of Exa credits (402), no other source. Nothing verified; product, versions, fix and default setting unknown. Settle by reading the NVD references/CPE list for this CVE, or the vendor advisory it links.

## From the sources

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_