Skip to content
Log inStart free trial

CVE-2025-2776

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality,…

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
64.73%
Chance of exploitation in the next 30 days. Higher than 99.24% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jul 22, 2025
Weakness
CWE-611 Improper Restriction of XML External Entity Reference
Fix
None yet
No fixed version published
Exploited in the wild. SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (SysAid SysAid On-Prem). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Aug 12, 2025.

Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it
  • Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-3x94-m842-937c
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
High Same weakness, CWE-611
GHSA-rxj4-h86g-25gc
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
High Same weakness, CWE-611
GHSA-8678-w3jw-xfc2
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
Low Same weakness, CWE-611
GHSA-x4r9-gmw3-hxww
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
High Same weakness, CWE-611
GHSA-x6g4-fwcc-jj8w
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
High Same weakness, CWE-611
GHSA-5wm8-gmm8-39j9
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
High Same weakness, CWE-611
GHSA-pj6p-9p8x-5mfc
Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host
High Same weakness, CWE-611
GHSA-rcc6-6q2f-m2cw
Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information
High Same weakness, CWE-611
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor