Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73235FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser

Medium 6.1

In plain English

A medium-severity XML external entity in FreeCAD from FreeCAD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.1%top 97.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12freecad0.20.2+dfsg1-4+deb12u1DEBIAN-CVE-2026-73235
Debian:13freecad1.0.0+dfsg-8+deb13u3DEBIAN-CVE-2026-73235
Debian:14freecad1.1.3+dfsg-1DEBIAN-CVE-2026-73235
Ubuntu:22.04:LTSfreecadno fix listedUBUNTU-CVE-2026-73235
Ubuntu:26.10freecadno fix listedUBUNTU-CVE-2026-73235

Affected products (as reported)

VendorProductVersions
FreeCAD FreeCAD < 1.1.2

Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References