Unauthenticated attackers can exploit XML External Entity processing in Lobster_pro prior to version 4.12.6‑GA. This flaw permits read access to files on the application server and adjacent network shares and enables arbitrary HTTP GET requests to external services. The result is unauthorized disclosure of sensitive data and the potential for further outbound communication that may facilitate additional attacks.

Lobster GmbH’s Lobster_pro is affected. All releases older than 4.12.6‑GA on Windows platforms are vulnerable and must be upgraded.

The CVSS score of 7.7 indicates high severity. EPSS is not available, so the probability of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated user submitting malicious XML to the application or an attacker with network access to the server. Successful exploitation can lead to confidential data disclosure and outbound traffic that may conceal further attacks.