UpHeron
All vulnerabilities

Servers and applications

CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Severity
Medium 5.5
Published
16 Nov 2016
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.9% in the next 30 daysHigher than 87% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
XML external entities (XXE) (CWE-611)
Attack
Needs local access · No login needed · Needs someone to click or open something
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
libxml2Servers and applications · cpe:a:xmlsoft:libxml2
  • Every version up to 2.9.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-9318
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-9318