The vulnerability allows an attacker who controls or can trick the documentation generation process into processing malicious XML to inject external entities. When the documentation tests for a remote API are run, these entities can resolve to local files or external resources, potentially leaking sensitive content. The flaw is a classic XML External Entity (XXE) injection, classified as CWE‑611, and can lead to confidentiality compromises. Based on the description, it is inferred that the attack can expose sensitive internal files or network resources through crafted XML.

Spring REST Docs for the module spring-restdocs-webtestclient and spring-restdocs-restassured is affected. The issue exists in Spring REST Docs versions 2.0.0.RELEASE through 2.0.8.RELEASE, 3.0.0 through 3.0.5, and 4.0.0. Systems using these versions that document remote APIs over HTTP are susceptible.

The CVSS score of 5.9 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploitation. The attack requires the attacker to either compromise the remote API or coerce a user into having the documentation tests run against a malicious API. It is primarily an environment‑based threat that can be invoked when the documentation generator processes untrusted XML. The likely attack vector is inferred as the execution of documentation tests against an attacker‑controlled or maliciously crafted API.