CVSS 3.1
7.6 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LCVE-2026-40882
High (7.6) in openremote openremote. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in io.openremote:openremote-manager 1.22.0.
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openremote:openremote
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g24f-mgc3-jwwc | Maven | io.openremote:openremote-manager | <1.22.0 | 1.22.0 |