Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request

published 2017-11-30 8 y ago modified 2026-06-17 4 mo ago also GHSA-cvj4-g3gx-8vqq , EUVD-2018-0584

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.

Patch / fix

fixed in 2 links 1

maven org.restlet.jse:org.restlet 2.3.12
restlet restlet 2.3.12

github.com/restlet/restlet-framework-java@fe75aff commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-14949 updated 2026-08-04 cvss 7.0

restlet: XXE vulnerability in XML extension allows remote attackers to access arbitrary files via a crafted REST API HTTP request

Red Hat JBoss Fuse 6 camel
affected: no fix available
Red Hat JBoss Fuse Service Works 6 org.restlet org.restlet
affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.41% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

lgtm.com https://lgtm.com/blog/restlet_CVE-2017-14949 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.restlet.jse:org.restlet	<2.3.12	2.3.12

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

github.com /restlet/restlet-framework-java/commit/fe75aff3af23b879b984db7a2b6824cee0ef0fc5
web
lgtm.com /blog/restlet_CVE-2017-14949
web, exploit, third-party-advisory
github.com /restlet/restlet-framework-java/wiki/XEE-security-enhancements
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2017-14949
advisory
github.com /advisories/GHSA-cvj4-g3gx-8vqq
advisory
github.com /restlet/restlet-framework-java
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary