Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

published 2026-04-30 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-55562

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Patch / fix

fixed in 1

4D 4D Server v20 R7

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-04-30)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

schutzwerk.com https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

4D 4D Server

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

schutzwerk.com /en/blog/schutzwerk-sa-2024-002/
exploit, third-party-advisory
4d.com
product
seclists.org /fulldisclosure/2026/May/0

Sources

CVE List CVE-2024-39847
NVD CVE-2024-39847

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary