Description
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.
References8
- github.com/yacy/yacy_search_server
- github.com/yacy/yacy_search_server/blob/Release_1.941/source/ne…
- github.com/yacy/yacy_search_server/blob/Release_1.941/source/ne…
- github.com/yacy/yacy_search_server/blob/Release_1.941/source/ne…
- github.com/yacy/yacy_search_server/commit/3c3a307e8b7a0ebbc4d1e…
- github.com/yacy/yacy_search_server/issues/818
- www.vulncheck.com/advisories/yacy-search-server-through-1.941-x…
- github.com/yacy/yacy_search_server/issues/818
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 4.0
-
8.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 49 · as of 8 November 2026
- CWE
- CWE-611
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.