cve.bz

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Filter

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-610 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-219 XML Routing Detour Attacks Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-610, as MITRE names them. Credits.

Ask an AI about CWE-610

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-610: Externally Controlled Reference to a Resource in Another Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/610.html and https://cve.bz/cve/cwe/610?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-119342EPSS 0.4%

    Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less ro…

  2. 4.2CVE-2026-67077EPSS 0.1%

    HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintend…

  3. 8.0CVE-2026-95376EPSS 0.2%

    Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: M…

  4. 8.3CVE-2026-81375EPSS 0.3%

    A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal file…

  5. 5.3CVE-2026-19032EPSS 0.6%

    jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(va…

  6. 4.4CVE-2026-21810EPSS 0.1%

    HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.

  7. 8.3CVE-2026-79256EPSS 0.4%

    Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTM…

  8. 4.3CVE-2026-78966EPSS 0.3%

    Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  9. 7.4CVE-2026-62960EPSS 0.5%

    Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-u…

  10. 5.1CVE-2026-76572EPSS 0.5%

    A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The att…

  11. 6.2CVE-2026-68562EPSS 0.3%

    A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause …

  12. 7.5CVE-2026-55390EPSS 0.6%

    datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import,…

  13. 7.5CVE-2026-55389EPSS 0.5%

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schem…

  14. 8.6CVE-2026-15583EPSS 0.5%

    A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables S…

  15. 5.9CVE-2026-12879EPSS 0.3%

    An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 1…

  16. 7.1CVE-2026-10816EPSS 0.6%

    Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

  17. 8.8CVE-2026-57301EPSS 0.6%

    Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

  18. 2.1CVE-2026-12788EPSS 0.4%

    A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the component XML Parser. This manipulatio…

  19. 9.8CVE-2026-47643EPSS 0.8%

    External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

  20. 4.3CVE-2026-0418EPSS 0.2%

    Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

  21. 8.1CVE-2026-45760EPSS 0.3%

    (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the …

  22. 9.2CVE-2026-47358EPSS 0.5%

    Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, i…

  23. 9.2CVE-2026-47357EPSS 0.5%

    Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unaut…

  24. 7.8CVE-2026-30905EPSS 0.1%

    External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

  25. 7.4CVE-2026-41107EPSS 0.7%

    External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

  26. 8.8CVE-2026-40370EPSS 0.6%

    External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

  27. 7.8CVE-2026-32204EPSS 0.3%

    External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

  28. 8.2CVE-2026-34327EPSS 0.6%

    Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.

  29. 6.8CVE-2026-30817EPSS 0.3%

    An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may all…

  30. 6.8CVE-2026-30816EPSS 0.3%

    An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.  Successful exploitation may a…

  31. 7.4CVE-2026-0522EPSS 0.6%

    A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subseq…

  32. 7.1CVE-2026-32008EPSS 0.4%

    OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers c…

  33. 9.8CVE-2026-30903EPSS 0.3%

    External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

  34. 7.3CVE-2026-28722EPSS 0.2%

    Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

  35. 7.3CVE-2026-28721EPSS 0.2%

    Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

  36. 7.8CVE-2025-48654EPSS 0.1%

    In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…

  37. 1.3CVE-2026-3404EPSS 0.4%

    A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity refere…

  38. 2.1CVE-2026-2536EPSS 0.3%

    A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File c…

  39. 2.1CVE-2026-2074EPSS 0.3%

    A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It…

  40. 2.1CVE-2026-1218EPSS 0.3%

    A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml extern…

  41. 6.3CVE-2025-15251EPSS 0.3%

    A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Messa…

  42. 7.1CVE-2025-68478EPSS 5.8%

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrite…

  43. 6.6CVE-2025-48598EPSS 0.1%

    In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction …

  44. 2.1CVE-2025-13209EPSS 0.3%

    A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation…

  45. 5.5CVE-2025-11341EPSS 0.5%

    A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity re…

  46. 5.5CVE-2025-11140EPSS 0.6%

    A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml …

  47. 2.1CVE-2025-11035EPSS 0.4%

    A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack…

  48. 5.5CVE-2025-10816EPSS 0.6%

    A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml e…

  49. 6.5CVE-2025-8057EPSS 0.3%

    Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue…

  50. 8.6CVE-2025-9065EPSS 0.5%

    A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing t…