{"id":"CVE-2026-127031","kind":"vulnerability","aliases":["CVE-2026-127031"],"related":[],"title":"Eclipse AAS4J: XML validation reads local files and makes outbound requests","description":"In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors.\n\n\n\nDetails:\n\n\n\n- Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`.\n\n\n\n- Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator.\n\n\n\n- `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there.\n\n\n\n- Present since the initial import of the code base (commit `cc9da52`).\n\n\n\n- Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `\"\"` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost.","summary":"Eclipse AAS4J's XML schema validator resolves external DTDs and entities when it checks an untrusted AAS XML document or AASX package. A crafted file can make the validating process read local files, send their contents to an attacker's server, and issue arbitrary outbound requests.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aas4j","aasx","industrial-digital-twin","java","package"],"not_affected_if":["trusted-input-only","xml-deserializer-only"],"how_to_check":"- Check the AAS4J version in the project's dependency file (for example `pom.xml` or `build.gradle`) for `org.eclipse.digitaltwin.aas4j` below `3.0.1`.\n- Check whether the application calls `XmlSchemaValidator.validateSchema()` or `AASXValidator.validateSchema()` on uploaded or external AAS XML or AASX files.","fix":"- Eclipse AAS4J: upgrade to `3.0.1` or later.","status":"open","published_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:24+00:00","updated_at":"2026-11-13T15:48:24+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T15:48:24Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse AAS4J: upgrade to `3.0.1` or later.","reach":"internet","title":"Eclipse AAS4J: XML validation reads local files and makes outbound requests","impact":"high","summary":"Eclipse AAS4J's XML schema validator resolves external DTDs and entities when it checks an untrusted AAS XML document or AASX package. A crafted file can make the validating process read local files, send their contents to an attacker's server, and issue arbitrary outbound requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","aas4j","industrial-digital-twin","aasx"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads local host files and makes server-side requests","analyst_note":"","how_to_check":"- Check the AAS4J version in the project's dependency file (for example `pom.xml` or `build.gradle`) for `org.eclipse.digitaltwin.aas4j` below `3.0.1`.\n- Check whether the application calls `XmlSchemaValidator.validateSchema()` or `AASXValidator.validateSchema()` on uploaded or external AAS XML or AASX files.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["xml-deserializer-only","trusted-input-only"],"who_is_affected":"Any application that uses the AAS4J library before 3.0.1 to validate AAS XML or AASX packages from untrusted sources is exposed, because the validator resolves external DTDs and entities by default. Applications that only deserialize trusted files with XmlDeserializer are not affected, since DTD support is off there by default. Systems that never validate untrusted input can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000822,"input_tokens":5083,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127031':14A,17A '-2026':13A,16A '/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/aasxvalidator.java':177C '/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/xmlschemavalidator.java':151C '3.0.1':76C 'aa':42B,104C,179C 'aas.xsd':237C 'aas4j':2A,18B,27B,74C 'aasx':19B,46B,108C,176C,184C 'aasxvalidator.validateschema':79C 'access':158C,161C,223C,227C 'affect':197C 'arbitrari':69B,136C 'attack':64B,99C,127C 'attacker-control':126C 'band':123C 'base':214C 'bundl':236C 'call':81C 'cc9da52':216C 'check':39B 'code':147C,213C 'commit':215C 'content':61B,119C 'control':128C 'craft':49B,103C 'cve':12A,15A 'dataformat':149C,175C 'dataformat-aasx':174C 'dataformat-xml':148C 'decl':170C 'declar':234C 'default':88C,204C 'detail':145C 'digit':22B 'disabl':202C 'disallow':168C 'disallow-doctype-decl':167C 'doctyp':169C,233C 'document':44B,106C 'dtd':160C,199C,225C 'dtds':34B,94C,241C 'eclips':1A,26B,73C 'entiti':36B,97C 'entri':172C 'error':144C 'extern':33B,93C,96C,159C,162C,224C,228C 'file':7A,50B,58B,113C 'fix':217C 'function':244C 'harden':218C 'host':116C 'import':210C 'industri':21B 'industrial-digital-twin':20B 'initi':209C 'issu':68B 'jackson/woodstox':194C 'java':24B 'jaxp':89C 'local':6A,57B,112C 'lost':246C 'make':9A,52B,131C 'need':240C 'new':154C 'out-of-band':120C 'outbound':10A,70B,137C 'packag':25B,47B,109C,185C 'part':181C 'pass':187C 'point':173C 'present':206C 'process':55B,134C 'read':5A,56B,111C 'reject':232C 'request':11A,71B,138C 'resolv':32B,92C 'restrict':164C 'return':142C 'run':156C 'schema':30B,163C,229C 'schema.newvalidator':152C 'second':171C 'send':59B,117C,135C 'server':66B,129C 'set':222C 'sinc':207C 'ssrf':139C 'still':141C 'streamsourc':155C 'suppli':101C 'support':200C 'twin':23B 'unchang':188C 'untrust':41B,84C 'valid':4A,31B,54B,83C,90C,133C,140C,153C,192C,220C 'vulner':146C,191C 'without':157C,166C 'xml':3A,29B,43B,85C,105C,150C,180C 'xmldeseri':193C 'xmlschemavalidator.validateschema':77C","nicknames":[],"mitigations":[],"who_affected":"Any application that uses the AAS4J library before 3.0.1 to validate AAS XML or AASX packages from untrusted sources is exposed, because the validator resolves external DTDs and entities by default. Applications that only deserialize trusted files with XmlDeserializer are not affected, since DTD support is off there by default. Systems that never validate untrusted input can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aas4j","aasx","high","industrialdigitaltwin","java","package"],"campaign_type":null,"search_a":"'-127031':14A,17A '-2026':13A,16A 'aas4j':2A 'cve':12A,15A 'eclips':1A 'file':7A 'local':6A 'make':9A 'outbound':10A 'read':5A 'request':11A 'valid':4A 'xml':3A","search_b":"'aa':42B 'aas4j':18B,27B 'aasx':19B,46B 'arbitrari':69B 'attack':64B 'check':39B 'content':61B 'craft':49B 'digit':22B 'document':44B 'dtds':34B 'eclips':26B 'entiti':36B 'extern':33B 'file':50B,58B 'industri':21B 'industrial-digital-twin':20B 'issu':68B 'java':24B 'local':57B 'make':52B 'outbound':70B 'packag':25B,47B 'process':55B 'read':56B 'request':71B 'resolv':32B 'schema':30B 'send':59B 'server':66B 'twin':23B 'untrust':41B 'valid':31B,54B 'xml':29B,43B","search_c":"'/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/aasxvalidator.java':177C '/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/xmlschemavalidator.java':151C '3.0.1':76C 'aa':104C,179C 'aas.xsd':237C 'aas4j':74C 'aasx':108C,176C,184C 'aasxvalidator.validateschema':79C 'access':158C,161C,223C,227C 'affect':197C 'arbitrari':136C 'attack':99C,127C 'attacker-control':126C 'band':123C 'base':214C 'bundl':236C 'call':81C 'cc9da52':216C 'code':147C,213C 'commit':215C 'content':119C 'control':128C 'craft':103C 'dataformat':149C,175C 'dataformat-aasx':174C 'dataformat-xml':148C 'decl':170C 'declar':234C 'default':88C,204C 'detail':145C 'disabl':202C 'disallow':168C 'disallow-doctype-decl':167C 'doctyp':169C,233C 'document':106C 'dtd':160C,199C,225C 'dtds':94C,241C 'eclips':73C 'entiti':97C 'entri':172C 'error':144C 'extern':93C,96C,159C,162C,224C,228C 'file':113C 'fix':217C 'function':244C 'harden':218C 'host':116C 'import':210C 'initi':209C 'jackson/woodstox':194C 'jaxp':89C 'local':112C 'lost':246C 'make':131C 'need':240C 'new':154C 'out-of-band':120C 'outbound':137C 'packag':109C,185C 'part':181C 'pass':187C 'point':173C 'present':206C 'process':134C 'read':111C 'reject':232C 'request':138C 'resolv':92C 'restrict':164C 'return':142C 'run':156C 'schema':163C,229C 'schema.newvalidator':152C 'second':171C 'send':117C,135C 'server':129C 'set':222C 'sinc':207C 'ssrf':139C 'still':141C 'streamsourc':155C 'suppli':101C 'support':200C 'unchang':188C 'untrust':84C 'valid':83C,90C,133C,140C,153C,192C,220C 'vulner':146C,191C 'without':157C,166C 'xml':85C,105C,150C,180C 'xmldeseri':193C 'xmlschemavalidator.validateschema':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127031","severity":null,"published_at":"2026-11-13T15:17:44+00:00","modified_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}