The vulnerability arises from Apache Abdera’s inadequate handling of XML external entity references when parsing Atom documents. Attackers can supply crafted XML that forces the parser to resolve external entities, enabling them to read internal files or send HTTP requests to internal networks. This results in confidentiality violations and potential server‑side request forgery, but does not provide arbitrary code execution.

All editions of Apache Abdera, which has been retired and is no longer maintained. Any downstream product that bundles an unpatched Abdera component is also affected.

The CVSS score of 8.7 reflects the high severity of the flaw, and the absence of a patch means the vulnerability remains exploitable indefinitely for installations that continue to use Abdera. The EPSS score is not available, yet the lack of updates implies a persistent exploitation risk. The issue is not listed in the CISA KEV catalog. Exploitation requires delivery of malicious XML to an application that uses Abdera, making the attack vector application‑dependent. The primary impact is data exposure and server‑side request forgery rather than remote code execution.