YaCy Search Server through version 1.941 is vulnerable to XML external entity injection through several parsers, including SVG, FreeMind, and OpenSearch. The vulnerability arises because the parsers enable external entity resolution, allowing a malicious document to declare a DOCTYPE with a SYSTEM entity that points to a local file. When the crawler processes such a document, it reads the referenced file and indexes its contents, effectively exfiltrating data from the hosting machine. The primary impact of this flaw is the disclosure of sensitive files and information that were not intended to be public, compromising confidentiality and potentially leading to further exploitation if the indexed data is accessed by attackers.

The affected product is the YaCy Search Server from the vendor yacy. Versions up to and including 1.941 are impacted. Earlier releases are presumed unaffected unless they include the same parser code. No other vendors or products are listed as affected.

The vulnerability carries a CVSS score of 8.7, indicating a high severity level. An EPSS score is not available, so the frequency of exploitation cannot be quantified from the data. The vulnerability is not listed in CISA’s KEV catalog, suggesting there are no confirmed large-scale exploits yet. Attackers do not need special privileges; they can submit a crafted document to the crawler or a public feed, resulting in the external entity being resolved by the server. This indicates a remote attack vector via the public web interface or ingestion API, making the flaw potentially exploitable by anyone who can generate a malicious document and trigger the crawler’s processing pipeline.