CVE-2026-73235 in FreeCAD
Summary
by MITRE • 08/11/2026
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in FreeCAD versions prior to 1.1.2 represents a critical XML external entity processing flaw that enables arbitrary file access and remote code execution capabilities. This issue stems from the improper configuration of the Xerces SAX2 XMLReader implementation within the Base::XMLReader::XMLReader() function located in src/Base/Reader.cpp. The vulnerability specifically occurs when processing attacker-controlled Document.xml content embedded within malicious .FCStd archive files, where the XML parser fails to disable default external entity resolution and external DTD loading mechanisms that are enabled by default in many XML parsers.
The technical exploitation of this vulnerability relies on the XML parser's ability to resolve external entities through various URI schemes including file:// and http:// protocols. When Document::restore() method processes the malicious document, the configured XMLReader automatically attempts to resolve external entities referenced within the XML content. This behavior allows attackers to craft malicious .FCStd files that contain XML references pointing to local system files through the file URI scheme, enabling unauthorized reading of sensitive files on the target system. Additionally, the vulnerability permits server-side request forgery attacks through HTTP URI scheme references, allowing attackers to initiate network requests from the victim's machine to external servers.
The operational impact of this vulnerability extends beyond simple information disclosure as it creates a complete attack vector for remote code execution and privilege escalation within the context of the FreeCAD application. The resolved content from external entities flows through the characters() callback method, providing attackers with multiple pathways to execute malicious code or exfiltrate data from the target system. This vulnerability affects all platforms running FreeCAD versions before 1.1.2 and represents a classic example of XML External Entity (XXE) processing vulnerabilities that have been documented in numerous security frameworks including CWE-611, which specifically addresses improper restriction of XML external entities. The ATT&CK framework categorizes this as a technique involving "Exploitation for Privilege Escalation" under the T1068 category, as successful exploitation can lead to unauthorized access and potential system compromise.
The fix implemented in FreeCAD version 1.1.2 addresses this vulnerability by properly configuring the XMLReader to disable external entity resolution and external DTD loading capabilities. This mitigation strategy aligns with industry best practices for preventing XXE attacks and follows the principle of least privilege in XML processing. Organizations should immediately upgrade to FreeCAD 1.1.2 or later versions to remediate this vulnerability, as the issue remains exploitable in older releases and represents a significant security risk for users who process untrusted .FCStd files from unknown sources. The vulnerability demonstrates the critical importance of proper XML parser configuration in applications that process external data formats, particularly in environments where users may encounter untrusted content.