CVE-2026-82880 in Search Server
Summary
by MITRE • 08/31/2026
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The YaCy Search Server, a decentralized peer-to-peer search engine software, contains a critical XML External Entity injection vulnerability in versions through 1.941. This flaw resides within the parsers responsible for handling SVG images, FreeMind mind maps, and OpenSearch descriptions. The core technical deficiency is that these components do not disable external entity resolution by default when processing incoming XML data. In standard XML parsing, entities allow for the inclusion of external resources or definitions. When an application fails to restrict this capability, it becomes susceptible to XXE attacks where an attacker can inject malicious DOCTYPE declarations into the input stream. These declarations define SYSTEM entities that point to local file paths on the server hosting the YaCy instance rather than remote URIs.
The operational impact of this vulnerability is severe and directly impacts data confidentiality through unauthorized information disclosure. When a user or crawler processes a document containing these crafted XML structures, the parser resolves the external entity by reading the contents of the specified local files from the underlying operating system. The vulnerable software then indexes these file contents as if they were legitimate search results. This mechanism effectively allows an attacker to exfiltrate sensitive data stored on the server, such as configuration files, source code, credentials, or other private documents, and make them searchable via the YaCy interface. An adversary can thus retrieve arbitrary local files by constructing specific payloads that reference paths like etc/passwd on Linux systems or critical system configurations on Windows environments.
From a classification perspective, this vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference. The attack vector leverages the trust placed in XML parsers to execute unintended side effects beyond simple data parsing. In terms of adversarial tactics, this behavior corresponds to ATT&CK technique T1083, File and Directory Discovery, as well as T1567, Exfiltration Over Web Service, since the stolen data is transmitted into a web-accessible index for retrieval. The vulnerability highlights the risks associated with legacy or less rigorously audited open-source components that may not adhere to modern secure coding practices regarding XML processing.
Mitigation strategies must focus on immediate patching and configuration hardening. Users running YaCy versions prior to 1.942 should upgrade to the latest stable release where this issue has been addressed by disabling external entity resolution in the affected parsers. For environments where upgrading is not immediately feasible, implementing a web application firewall with rules capable of detecting and blocking XML documents containing DOCTYPE declarations or ENTITY definitions can provide a layer of defense. Additionally, developers integrating YaCy should ensure that any custom parsing logic explicitly disables DTD processing and external entities using secure parser configurations provided by the underlying XML library. Regular security audits of third-party dependencies are essential to prevent similar vulnerabilities in future deployments.