esaml and its forks parse attacker‑controlled SAML messages with xmerl_scan:string/2 before signature validation, leaving XML entity expansion enabled on Erlang/OTP versions earlier than 27. This configuration permits a pre‑signature XML External Entity (XXE) attack, allowing an adversary to embed entities that reference arbitrary local files (such as Kubernetes‑mounted secrets) into the SAML envelope. When processed, the application reads these files and injects their contents into the SAML document; if the actor is not a trusted Service Provider the signature check will fail and the message will be discarded, yet the file data can still leak via logs or error messages. The flaw also opens the door to Server‑Side Request Forgery through crafted SAML packets. The vulnerability is identified as CWE‑611 and carries a CVSS score of 6.3.

All releases of the esaml library and its forks—including Jump‑App esaml, arekinath esaml, dropbox esaml, and handnot2 esaml—are affected. Every available version before Erlang/OTP 27 carries the flaw, while users on OTP 27 or later are not impacted.

The risk is moderate, with a CVSS score of 6.3 and an EPSS score lower than 1 %. The vulnerability is not listed in the CISA KEV catalog, indicating it is not currently known to be exploited in the wild. The likely attack vector involves an attacker sending a specifically crafted SAML message to the target application over the network; the vulnerability can be triggered without authentication depending on the application’s exposure of the SAML endpoint. If the attacker is not a trusted service provider, signature verification will fail but the local file contents may still leak through logs, providing potential information disclosure and further exploitation via SSRF. The workaround of upgrading to Erlang/OTP 27 or later disables entity expansion by default, greatly reducing exploitability.