The flaw stems from the XML parser employed by the SOAP endpoints of 4D Server, permitting an unauthenticated attacker to send a crafted XML payload that triggers the XML External Entity (XXE) functionality. This results in the ability to read arbitrary files on the server and on adjacent shared resources, and to issue HTTP GET requests to any target host reachable from the server—effectively a Server‑Side Request Forgery (SSRF). The weakness, classified as CWE‑611, exposes confidential data and permits potential lateral movement within the network.

The vulnerability targets the 4D Server product (4D:4D Server) on Windows platforms. All releases preceding 4D Server 20 R 7 are affected; the 20 R 7 build and later contain the fix and are no longer vulnerable.

With a CVSS v3.1 score of 8.7 the flaw is considered high severity. Attackers need no credentials and can reach the vulnerable SOAP service over the network, making remote exploitation straightforward. Although the EPSS score is currently unknown and the issue has not yet been recorded in the CISA KEV catalog, the potential for data exfiltration and internal pivoting renders the risk significant for exposed deployments.