This issue is an XML External Entity (XXE) injection that impacts Tolgee’s translation import feature. When the platform processes Android XML or ResX files without disabling external entity handling, a specially crafted file can be used to cause the server to read files from its own file system or to make outbound requests to internal services. The result is a breach of confidentiality and a potential side‑channel to internal resources, though no denial of service or arbitrary code execution was reported.

All deployments of the Tolgee Platform before release 3.166.3 are affected. The flaw exists regardless of file type and is only exploitable by users who have permission to import translations – that is, authenticated users within projects. Version 3.166.3 and later patch the XML parsers to disable external entity processing, eliminating the vulnerability.

The CVSS score of 9.3 classifies this vulnerability as critical. The EPSS score is below 1%, and it is not listed in the CISA KEV catalog, indicating that public exploitation has not been observed. It is inferred that the likely attack vector is the translation import interface where a malicious file is uploaded. Because exploitation requires an authenticated user with import rights, the threat is limited to environments where such permissions are granted. An attacker who can authenticate as such a user can read arbitrary files on the server and cause internal network requests, but no arbitrary code execution is possible.