HAPI FHIR’s XsltUtilities.saxonTransform overloads instantiate a net.sf.saxon.TransformerFactoryImpl without setting the ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET properties. This allows entity resolution when the XML input contains external entity references, enabling an attacker who controls or can tamper with the XML to inject external entities. The result can be local file disclosure or blind SSRF to arbitrary URLs reachable from the host, directly violating data confidentiality.

The vulnerability affects the org.hl7.fhir.core component of HAPI FHIR. All deployments running versions earlier than 6.9.10 are susceptible; the issue is resolved in releases starting with 6.9.10.

The CVSS base score of 8.7 indicates high severity. The EPSS score is less than 1 %, suggesting that the likelihood of exploitation in the wild is low at present. The flaw is not listed in the CISA KEV catalog. Attackers would need a path to supply crafted XML to the XsltUtilities.saxonTransform method, which is possible through a healthcare data exchange that accepts external XML. If achieved, the attacker could read local files or force outbound network connections from the host.