Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) weakness in its XStream‑based XML parsing, allowing attacker‑controlled XML to trigger processing of external entities. This can expose local files or cause the application to resolve and request arbitrary URLs, leading to file disclosure or Server‑Side Request Forgery. The underlying flaw is improper input validation when parsing XML, which can compromise confidentiality and trust boundaries.

The vulnerability affects the Oinone Pamirs 7.0.0 release. No other products or vendors are listed as impacted in the available data.

The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, indicating a currently unknown exploitation probability. The CVSS score of 6.5 indicates a moderate severity. Because the flaw is triggered by passing crafted XML to specific framework parsing entry points (e.g., PamirsXmlUtils.fromXML or ViewXmlUtils.fromXML), an attacker would need remote or local access to an endpoint that accepts XML payloads. The impact could be significant if the application is exposed publicly or trusts untrusted XML input, but without an exploit score or documented active exploitation, the threat is considered moderate to high in environments that openly parse XML.