CVE-2018-1000831

10.0 criticalEPSS 1.9%

Critical (10.0) in k9mail k-9 mail. EPSS 1.9% chance of exploitation in the next 30 days.

K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.

Severity

CVSS 3.0

10.0 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

k9mail:k-9_mail

References

https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681
https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681

Check your stack JSON