Copernik XML Factory prior to v0.1.2 fails to restrict XInclude resource resolution when the stock JDK provider is used and XInclude processing is enabled. An application that receives untrusted XML can embed an xi:include element pointing to arbitrary local files or HTTP URLs. This can expose sensitive data from the file system or allow the attacker to reach internal network endpoints via server‑side request forgery. The flaw is a CWE‑611 vulnerability that allows uncontrolled inclusion of external resources, compromising confidentiality and potentially availability if resources are exhausted.

The vulnerability affects the Copernik XML Factory library published by copernik-eu. Versions prior to 0.1.2 are affected, while the 0.1.2 release contains a fix. Applications that configure XmlFactories.newDocumentBuilderFactory() or newSAXParserFactory() with XInclude enabled and use the stock JDK provider without including the Apache Xerces provider are susceptible.

A CVSS score of 8.2 indicates high severity. Because the flaw relies on configuration of XInclude and the presence of the stock JDK provider, it can be exercised by servers that parse untrusted XML on the internet. The absence of an available EPSS score means the likelihood cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The main exploitation path requires the attacker to supply crafted XML to an application that has enabled XInclude, which many enterprise services do. If the application does not enable XInclude or uses a protected provider such as Xerces, the risk is mitigated.