Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-55471HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

High 8.7

In plain English

A high-severity XML external entity in org.hl7.fhir.core from hapifhir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.utilities	6.9.10	GHSA-2f55-g35j-5jmf

Affected products (as reported)

Vendor	Product	Versions
hapifhir	org.hl7.fhir.core	< 6.9.10

Weakness: CWE-611 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf x_refsource_CONFIRM
https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10 x_refsource_MISC