Description
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.
Published: 2026-08-14
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Datavane TIS 5.0.0 contains an XML external entity (XXE) injection flaw that allows authenticated attackers to send a crafted taskScript XML to the doEditWorkflow endpoint. The server parses XML with an unhardened DocumentBuilderFactory that permits external entity references and DTD loading, enabling server‑side request forgery and out‑of‑band exfiltration of configuration files and database credentials (CWE‑611).

Affected Systems

The vulnerability is present in Datavane TIS version 5.0.0. No other vendors or product versions are currently listed as affected. Administrators should ensure they are not running this version and consult Datavane for updates.

Risk and Exploitability

The issue scores a CVSS of 8.3, indicating high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so the exploitation likelihood is uncertain, but the flaw requires only an authenticated session. Attackers can potentially perform SSRF and read local files if the endpoint is reachable, making prompt remediation a priority.

Generated by OpenCVE AI on August 14, 2026 at 15:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Reconfigure the TIS XML parser to disable external entity parsing and DTD loading.
  • Restrict the service account’s file system and network permissions so it cannot read sensitive files or initiate arbitrary outbound connections.
  • Monitor application logs for unexpected outbound HTTP requests or file access attempts to detect exploitation.

Generated by OpenCVE AI on August 14, 2026 at 15:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Datavane
Datavane tis
Vendors & Products Datavane
Datavane tis

Fri, 14 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.
Title Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Datavane Tis
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-14T19:06:18.712Z

Reserved: 2026-08-03T10:44:14.336Z

Link: CVE-2026-69101

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T15:17:10.053

Modified: 2026-08-14T19:17:56.140

Link: CVE-2026-69101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T16:00:05Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference