Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2026-3511

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-3511
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 12:08 UTC · Revision 1

Source evidence

CVE-2026-3511

core-osv · Original source

Published 19 Mar 2026, 12:16 UTC

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

osv:CVE-2026-3511
Complete source record
{
  "id": "878b1ac96a2d9572e03c6817cb358227981f68ec311d82d8a6777c7744a31215",
  "url": "https://osv.dev/vulnerability/CVE-2026-3511",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-3511",
    "summary": "Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.",
    "evidence": "osv:CVE-2026-3511",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-3511",
      "aliases": [
        "CVE-2026-3511"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/slovensko-digital/autogram",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "733cf74b085e9b0fdf7cfc9b9b9c35a82f491e60"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "733cf74b085e9b0fdf7cfc9b9b9c35a82f491e60"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.7.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.7.1",
            "v2.7.0",
            "v2.6.1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.4",
            "v2.2.100",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.9",
            "v2.1.6",
            "v2.1.5",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.5",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v1.99.23",
            "v1.99.22",
            "v1.99.21",
            "v1.99.20",
            "v1.99.19",
            "v1.89.19",
            "v1.99.18",
            "v1.99.17",
            "v1.99.16",
            "v1.99.15",
            "v1.99.14",
            "v1.99.13",
            "v1.99.12",
            "v1.99.11",
            "v1.99.1",
            "v1.99.10",
            "v1.99.9",
            "1.99.9",
            "1.99.6",
            "v1.99.0",
            "v1.0.94",
            "v1.0.93",
            "v1.0.92",
            "v1.0.91",
            "v0.0.6",
            "0.0.6",
            "v0.0.5",
            "0.0.5",
            "v0.0.3",
            "v0.0.2",
            "release-29-12-2021",
            "dev-2021-09-30"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3511.json"
          }
        }
      ],
      "modified": "2026-10-20T12:08:53.775164611Z",
      "provider": "osv",
      "references": [
        "https://github.com/slovensko-digital/autogram/releases/tag/v2.7.2",
        "https://blog.binary.house/2026/03/pripadova-studia-ako-sme-s-claude-code.html"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-3511",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 387253,
  "published_at": "2026-03-19T12:16:18.647+00:00"
}