esaml and its forks parse SAML messages with xmerl_scan:string/2 before signature verification, leaving XML entity expansion enabled on Erlang/OTP versions below 27. This allows an attacker to craft a SAML message that includes XML entities that reference local files. When the message is processed, the system reads the specified file and injects its contents into the SAML document. Because signature verification runs later, the document may be discarded yet the read data can appear in logs or error messages, exposing sensitive information. The vulnerability is identified as CWE-611 and has a CVSS score of 6.3.

All releases of the esaml library and its forks—Jump-App esaml, arekinath esaml, dropbox esaml, handnot2 esaml—are affected. Version information is not limited; every available version before the OTP 27 change is at risk.

The risk is moderate, with a CVSS score of 6.3 and EPSS score lower than 1 %. The vulnerability is not listed in the CISA KEV catalog, indicating it is not currently known to be exploited in the wild. The likely attack vector involves an attacker sending a specifically crafted SAML message to the target application over the network; the vulnerability can be triggered without authentication depending on the application’s exposure of the SAML endpoint. If the attacker is not a trusted service provider, signature verification will fail but the local file contents may still leak through logs, providing potential information disclosure and further exploitation via SSRF. The workaround of upgrading to Erlang/OTP 27 or later disables entity expansion by default, greatly reducing exploitability.