This vulnerability is an XML External Entity (XXE) flaw in the Velbus asset import feature of OpenRemote in versions prior to 1.22.0. An authenticated user who can call the import endpoint can supply crafted XML that triggers external entity resolution, enabling the server to read local files up to 1023 characters in length and to make arbitrary outbound HTTP requests (SSRF). This can lead to the disclosure of sensitive data or facilitate further exploitation of external services.

The flaw affects all installations of OpenRemote that use a version earlier than 1.22.0. OpenRemote is an open‑source Internet‑of‑Things platform, and the affected component is the Velbus asset import endpoint. Any deployment that has integrated this feature without upgrading to 1.22.0 or later is vulnerable.

The CVSS score of 7.6 indicates high severity. Authentication is required to reach the vulnerable endpoint, so exploitation is limited to users with valid credentials. The EPSS metric is not available and the CVE is not listed in CISA KEV, suggesting no widespread public exploitation is known. Nonetheless, the combination of server‑side file read and SSRF could enable attackers to exfiltrate data or compromise external resources if they gain sufficient permission.