Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M

CVE-2026-54640OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

High 7.6

In plain English

A high-severity XML external entity in openremote-manager from io.openremote. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 87.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.openremote:openremote-agent	1.24.2	GHSA-7v6w-c3f4-9wpq

Affected products (as reported)

Vendor	Product	Versions
openremote	openremote	< 1.24.2
io.openremote	openremote-manager	< 1.24.2

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/openremote/core/security/advisories/GHSA-7v6w-c3f4-9wpq x_refsource_CONFIRM
https://github.com/openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9 x_refsource_MISC
https://github.com/openremote/core/releases/tag/1.24.2 x_refsource_MISC