CVE-2026-3511 in Autogram
Summary
by MITRE • 03/19/2026
Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/23/2026
The vulnerability identified as CVE-2026-3511 represents a critical security flaw in the Slovensko.Digital Autogram application's XML processing functionality. This issue manifests as an improper restriction of XML External Entity references within the XMLUtils.java component, creating a pathway for malicious actors to exploit server-side processing mechanisms. The vulnerability specifically affects the application's handling of XML documents submitted through the /sign endpoint, where the system fails to adequately validate or sanitize external entity references that could be embedded within incoming XML payloads. This weakness enables attackers to manipulate the application's XML parser behavior and potentially access internal system resources that should remain protected from external influence.
The technical exploitation of this vulnerability follows a Server Side Request Forgery attack pattern where an unauthenticated remote attacker can craft malicious XML documents that, when processed by the vulnerable application, trigger unintended network requests or file system operations. The XML External Entity processing flaw allows attackers to reference external resources or local file paths through entity declarations within the XML document structure. When the application processes these documents, the XML parser resolves external entities, potentially causing the server to make unintended HTTP requests to internal services or read local files that contain sensitive information such as system configuration details, authentication credentials, or private data stored on the filesystem. This particular vulnerability falls under CWE-611, which specifically addresses improper restriction of XML external entity reference, and aligns with ATT&CK technique T1190 for exploiting XML external entity injection vulnerabilities.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to potentially gain unauthorized access to local system resources through the application's server-side processing capabilities. Successful exploitation could allow an attacker to perform reconnaissance activities by accessing local files, potentially leading to privilege escalation or further compromise of the system. The vulnerability requires minimal user interaction, as victims need only visit a specially crafted website that automatically submits malicious XML content to the target application's /sign endpoint. This makes the attack vector particularly dangerous as it can be executed without the victim's knowledge or consent, creating a significant risk for organizations that rely on the Autogram application for digital signature processing. The attack scenario demonstrates how a seemingly simple XML processing function can become a critical entry point for broader system compromise, highlighting the importance of proper input validation and secure XML parsing practices in web applications.
Organizations affected by this vulnerability should implement immediate mitigations including disabling external entity resolution in XML parsers, implementing strict XML schema validation, and restricting network access to internal resources from the application server. The recommended approach involves configuring the XML parser to reject external entity references entirely and implementing proper input sanitization measures that prevent malicious XML constructs from being processed. Additionally, network segmentation and firewall rules should be implemented to limit the application's ability to make unauthorized outbound connections, effectively reducing the attack surface for potential SSRF exploitation. Security monitoring should be enhanced to detect unusual patterns of XML processing or network requests that might indicate exploitation attempts, while regular security updates and patches should be deployed to address the underlying vulnerability in the application's XML processing component.