Datavane TIS up to 5.0.0 DocumentBuilderFactory edit_workflow taskScript xml external entity reference

Summaryinfo

A vulnerability classified as critical was found in Datavane TIS up to 5.0.0. Affected is the function edit_workflow of the component DocumentBuilderFactory. Such manipulation of the argument taskScript leads to xml external entity reference. This vulnerability is documented as CVE-2026-69101. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Datavane TIS up to 5.0.0. Affected by this issue is the function edit_workflow of the component DocumentBuilderFactory. The manipulation of the argument taskScript with an unknown input leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-69101 since 08/03/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Datavane

Name

• TIS

Version

• 5.0

Website

• Product: https://github.com/datavane/tis/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion