powsybl-core up to 6.7.1 XML Parser com.powsybl.commons.xml.XmlReader xml external entity reference

Summaryinfo

A vulnerability categorized as problematic has been discovered in powsybl-core up to 6.7.1. Impacted is the function com.powsybl.commons.xml.XmlReader of the component XML Parser. Executing a manipulation can lead to xml external entity reference. The identification of this vulnerability is CVE-2025-47293. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in powsybl-core up to 6.7.1 and classified as critical. This vulnerability affects the function com.powsybl.commons.xml.XmlReader of the component XML Parser. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-47293 since 05/05/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 6.7.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch e6c7c4997ae8758b54a2f23ce1a499e25113acdc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18700). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• powsybl-core

Version

• 6.7.0
• 6.7.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion