CVE-2026-54640 json
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
published 2026-07-06 4 mo ago modified 2026-10-16 23 d ago also EUVD-2026-98841 , GHSA-7v6w-c3f4-9wpq
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.
Patch / fix
- maven io.openremote:openremote-agent 1.24.2
- openremote openremote 1.24.2
- io.openremote openremote-manager 1.24.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 26 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.openremote:openremote-agent | <1.24.2 |
1.24.2 |
Affected products
- openremote openremote
- io.openremote openremote-manager
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
- github.com /openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9
-
github.com
/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9
web
- github.com /openremote/core/security/advisories/GHSA-7v6w-c3f4-9wpq
- github.com /openremote/core/releases/tag/1.24.2
-
github.com
/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq
web
-
github.com
/openremote/openremote
package
Sources
- CVE List CVE-2026-54640
- GitHub Advisory GHSA-7v6w-c3f4-9wpq
- NVD CVE-2026-54640
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.