Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
Published: 2026-07-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

HAPI FHIR, a Java implementation of the HL7 FHIR standard, contains an XSLT utility that uses an unconfigured Saxon TransformerFactoryImpl, lacking ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions. This allows an attacker who can control or tamper with the XML supplied to the transform to perform XML External Entity injection, exposing local files or enabling blind SSRF to arbitrary URLs reachable from the host. The vulnerability was fixed in version 6.9.10.

Affected Systems

The vulnerability affects the org.hl7.fhir.core component of HAPI FHIR. All deployments running versions earlier than 6.9.10 are susceptible; the issue is resolved in releases starting with 6.9.10.

Risk and Exploitability

The CVSS base score of 8.7 indicates high severity. The EPSS score is less than 1 %, suggesting that the likelihood of exploitation in the wild is low at present. The flaw is not listed in the CISA KEV catalog. Attackers would need a path to supply crafted XML to the XsltUtilities.saxonTransform method, which is possible through a healthcare data exchange that accepts external XML. If achieved, the attacker could read local files or force outbound network connections from the host.

Generated by OpenCVE AI on August 1, 2026 at 15:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade HAPI FHIR to version 6.9.10 or later to apply the official fix that enforces ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions.
  • Validate or sanitize XML input before it is passed to XsltUtilities.saxonTransform to eliminate the possibility of external entity references being processed.
  • Limit the Java process’s network and filesystem permissions, or run the transformation in a sandboxed environment, to reduce the impact of any remaining XXE or SSRF vector.

Generated by OpenCVE AI on August 1, 2026 at 15:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2f55-g35j-5jmf HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
History

Wed, 22 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Important

Fri, 10 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Hapifhir
Hapifhir hl7 Fhir Core
Vendors & Products Hapifhir
Hapifhir hl7 Fhir Core

Thu, 09 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
Title HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Weaknesses CWE-611
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

Hapifhir Hl7 Fhir Core
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T13:26:16.545Z

Reserved: 2026-06-16T22:10:37.608Z

Link: CVE-2026-55471

cve-icon Vulnrichment

Updated: 2026-07-09T13:25:42.265Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-08T22:17:15.520

Modified: 2026-07-16T16:32:45.880

Link: CVE-2026-55471

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-08T21:28:45Z

Links: CVE-2026-55471 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T15:30:03Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference