An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java

published 2021-09-11 5 y ago modified 2026-06-17 4 mo ago also GHSA-838r-hvwh-24h8 , EUVD-2021-2011

cvss: 9.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.8%; EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits: 0; none known

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

Patch / fix

fixed in 2

maven org.apache.any23:apache-any23 2.5
Apache Software Foundation Apache Any23 2.5

Exploit prediction

2.75% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.any23:apache-any23	<2.5	2.5

Affected products

Apache Software Foundation Apache Any23

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

lists.apache.org /thread.html/r589d1a9f94dbeee7a0f5dbe8513a0e300dfe669bd964ba2fbfe28e07%40%3Cannounce.apache.org%3E
web, mailing-list, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2021-38555
advisory
github.com /apache/any23
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary