An XML external entity (XXE) flaw in the /designer/loadReport endpoint of SpringBlade v4.8.0 lets authenticated users supply crafted XML that can resolve external entities at the server, enabling arbitrary code execution on the host. The vulnerability stems from the XML parser re‑allowing external entity resolution, a classic CWE‑611 weakness. The attacker can execute commands or exploit the server environment, compromising confidentiality, integrity, or availability of data and services.

SpringBlade version 4.8.0 is affected. No additional vendor or product information is listed in the CVE entry.

The CVSS score is not provided and the EPSS is not available, so the precise severity and exploitation probability are unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and have access to the /designer/loadReport endpoint; they can then inject a malicious XML payload to achieve code execution. Because no exploit probability data is available, it is prudent to assume the risk is significant but unknown, and that mitigation steps should be taken promptly.