The flaw is an improper restriction of recursive entity references in DTDs, known as XML External Entity (XEE). When an attacker submits crafted XML to the fp: form processor of Apache Cocoon, the parser may resolve external entities, enabling it to reach internal resources. This can result in Server Side Request Forgery (SSRF) that delivers internal files or initiates requests to external systems, as well as unintended disclosure of sensitive data. The weakness is classified as CWE-776.

All historical releases of Apache Cocoon, the content transformation and web publishing framework maintained by the Apache Software Foundation, are affected. The project is retired and is no longer actively maintained, so no fixes or updates are planned. The vulnerability applies to every version that still uses the fp: form processor with the default XML parsing configuration.

The CVSS base score is 7.5 and the EPSS score is below 1 %, indicating a low empirical probability of exploitation, but the risk remains significant because the software is unpatched and may be accessible from untrusted networks. It is inferred that the attack vector is the HTTP/HTTPS interface of the form processor, as the processor accepts XML payloads over standard web requests. The flaw is not listed in the CISA KEV catalog, so no active exploitation has been reported publicly. In environments where the application is reachable from external users, the possibility of SSRF or data leakage remains.