Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-82525Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Medium 5.5

In plain English

A medium-severity XML external entity in FTK Imager from Exterro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.

Affected products (as reported)

Vendor	Product	Versions
Exterro	FTK Imager	0 – before 8.3

Weakness: CWE-611, CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Release Notes release-notes
Download Page product, patch
https://www.vulncheck.com/advisories/exterro-ftk-imager-xxe-via-report-xml-xslt-processing third-party-advisory