{"id":"CVE-2026-120761","kind":"vulnerability","aliases":["CVE-2026-120761"],"related":[],"title":"Apache Axis2/Java: WSDL imports let attackers read local files","description":"Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"Apache Axis2/Java parses WSDL and imported schema documents with an XML parser that resolves external entities when a client builds a service from a WSDL URL. An attacker who controls the WSDL or an imported document can read local files on the client machine or make the JVM send network requests.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axis2","java","package","soap","wsdl"],"not_affected_if":["hard-coded-wsdl","no-wsdl-client"],"how_to_check":"- Check the Axis2 version in the project's dependencies, for example `org.apache.axis2:axis2-kernel` or `axis2` in the build file.\n- Look for code that calls `ServiceClient` or `AxisService.createClientSideAxisService` with a WSDL URL that comes from outside the system.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:55+00:00","updated_at":"2026-11-09T11:26:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T11:26:55Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`.","reach":"network","title":"Apache Axis2/Java: WSDL imports let attackers read local files","impact":"medium","summary":"Apache Axis2/Java parses WSDL and imported schema documents with an XML parser that resolves external entities when a client builds a service from a WSDL URL. An attacker who controls the WSDL or an imported document can read local files on the client machine or make the JVM send network requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","axis2","soap","wsdl"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"local files readable and internal network requests made from the JVM","analyst_note":"","how_to_check":"- Check the Axis2 version in the project's dependencies, for example `org.apache.axis2:axis2-kernel` or `axis2` in the build file.\n- Look for code that calls `ServiceClient` or `AxisService.createClientSideAxisService` with a WSDL URL that comes from outside the system.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hard-coded-wsdl","no-wsdl-client"],"who_is_affected":"Only Java code that builds an Axis2 client from a WSDL URL is exposed, because that path enables wsdl4j import resolution. The risk is highest when the WSDL location can be chosen or altered by an outside party. Services that only use hard-coded, trusted WSDL files are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":4685,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120761':12A,15A '-2026':11A,14A '2.0.1':156C '2.0.2':164C 'affect':152C 'apach':1A,21B,81C,153C 'attack':6A,48B,128C 'axis2':16B 'axis2/java':2A,22B,82C,154C 'axisservic':88C 'axisservice.createclientsideaxisservice':96C 'build':40B 'built':86C 'client':39B,63B,85C 'control':50B,130C 'could':138C 'cve':10A,13A 'declar':123C 'doctyp':122C 'document':28B,56B,104C,135C 'enabl':101C 'entiti':36B,77C,126C 'extern':35B,76C,125C 'file':9A,60B,142C 'fix':166C 'import':4A,26B,55B,98C,108C,111C,137C 'improp':72C 'issu':147C,151C,168C 'java':17B 'jvm':68B,146C 'let':5A 'local':8A,59B,141C 'machin':64B 'make':66B,144C 'name':105C 'network':70B,148C 'packag':18B 'pars':23B,113C 'parser':32B,119C 'process':121C 'read':7A,58B,140C 'recommend':159C 'refer':78C 'request':71B,149C 'resolut':99C 'resolv':34B 'restrict':73C 'schema':27B 'send':69B 'servic':42B 'servicecli':94C 'soap':19B 'therefor':139C 'upgrad':161C 'url':46B,92C 'user':157C 'version':163C 'vulner':79C 'wsdl':3A,20B,24B,45B,52B,91C,107C,132C 'wsdl4j':97C,115C 'xml':31B,75C,118C 'xsd':110C","nicknames":[],"mitigations":[],"who_affected":"Only Java code that builds an Axis2 client from a WSDL URL is exposed, because that path enables wsdl4j import resolution. The risk is highest when the WSDL location can be chosen or altered by an outside party. Services that only use hard-coded, trusted WSDL files are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axis2","java","package","soap","unknown","wsdl"],"campaign_type":null,"search_a":"'-120761':12A,15A '-2026':11A,14A 'apach':1A 'attack':6A 'axis2/java':2A 'cve':10A,13A 'file':9A 'import':4A 'let':5A 'local':8A 'read':7A 'wsdl':3A","search_b":"'apach':21B 'attack':48B 'axis2':16B 'axis2/java':22B 'build':40B 'client':39B,63B 'control':50B 'document':28B,56B 'entiti':36B 'extern':35B 'file':60B 'import':26B,55B 'java':17B 'jvm':68B 'local':59B 'machin':64B 'make':66B 'network':70B 'packag':18B 'pars':23B 'parser':32B 'read':58B 'request':71B 'resolv':34B 'schema':27B 'send':69B 'servic':42B 'soap':19B 'url':46B 'wsdl':20B,24B,45B,52B 'xml':31B","search_c":"'2.0.1':156C '2.0.2':164C 'affect':152C 'apach':81C,153C 'attack':128C 'axis2/java':82C,154C 'axisservic':88C 'axisservice.createclientsideaxisservice':96C 'built':86C 'client':85C 'control':130C 'could':138C 'declar':123C 'doctyp':122C 'document':104C,135C 'enabl':101C 'entiti':77C,126C 'extern':76C,125C 'file':142C 'fix':166C 'import':98C,108C,111C,137C 'improp':72C 'issu':147C,151C,168C 'jvm':146C 'local':141C 'make':144C 'name':105C 'network':148C 'pars':113C 'parser':119C 'process':121C 'read':140C 'recommend':159C 'refer':78C 'request':149C 'resolut':99C 'restrict':73C 'servicecli':94C 'therefor':139C 'upgrad':161C 'url':92C 'user':157C 'version':163C 'vulner':79C 'wsdl':91C,107C,132C 'wsdl4j':97C,115C 'xml':75C,118C 'xsd':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120761","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[{"id":107111,"url":"https://github.com/apache/axis-axis2-java-core/commit/1d3457d12399c7721ed3f52e7031d1d24d169460","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}