The vulnerability lies in the XML parsing logic of FreeCAD 1.1.1 and earlier where the Xerces SAX2 XMLReader does not disable external entity resolution or external DTD loading. Attackers can embed malicious external entities in the Document.xml file inside a .FCStd archive. When the Document::restore() function processes the archive, the external entity can resolve local file contents via a file:// URI or trigger HTTP requests to arbitrary servers via an http:// URI, causing local file disclosure and potential SSRF. The flaw is identified as CWE-611 and can lead to information disclosure and unintended network traffic from the host.

The affected product is the FreeCAD application. All releases before version 1.1.2 are vulnerable, including the 1.1.x series and prior releases. Systems running these versions and that will open or import untrusted .FCStd files are susceptible. The fix is delivered in release 1.1.2 and later.

The CVSS score of 6.1 rates this as a medium severity vulnerability, and the EPSS score indicates an exploitation probability of less than 1 percent, suggesting the risk of immediate exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exfiltration of local files or initiation of server‑side requests requires a user to open a malicious .FCStd document; therefore the attack vector is primarily local. Once the affected application is run with a crafted file, the external entity resolution is automatically enabled, and the attacker’s payload is processed through the characters() callback.