Vulnerability · Published Mar 19, 2026 · Assigned by SK-CERT
CVE-2026-3511
High 8.6
In plain English
A high-severity XML external entity in Autogram from Slovensko.Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Slovensko.Digital | Autogram | 0 – before 2.7.2 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N