CVE-2018-1000838

10.0 criticalEPSS 2.5%

Critical (10.0) in sleuthkit autopsy. EPSS 2.5% chance of exploitation in the next 30 days.

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.

Severity

CVSS 3.0

10.0 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sleuthkit:autopsy

References

https://0dd.zone/2018/10/28/autopsy-XXE/
https://github.com/sleuthkit/autopsy/issues/4236
https://0dd.zone/2018/10/28/autopsy-XXE/
https://github.com/sleuthkit/autopsy/issues/4236

Check your stack JSON