The flaw resides in libxml2’s handling of XInclude processing; the functions xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the parser’s parseFlags. Because the XML_PARSE_NONET flag is not carried forward, an included resource may be fetched over the network even when the caller intended to disallow external access. This unchecked fetch enables an attacker to trigger XML External Entity injection, Server Side Request Forgery, or a denial‑of‑service if the external resource is malicious or intentionally slow. The vulnerability is classified as CWE‑611 (XML External Entity) and CWE‑669 (Improper Logic).

All installations of libxml2 built from the xmlsoft project that are older than version 2.15.4 and that process XML with XInclude support are affected. Because libxml2 is incorporated in a wide range of software stacks—including web servers, data transformation tools, configuration parsers, and other applications that ingest XML—this issue can potentially impact numerous systems across multiple sectors.

The CVSS base score of 5.6 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog and no public exploits are known. Attack execution requires the ability to supply XML input that triggers XInclude processing with the XML_PARSE_NONET flag not enforced; the likely attack vector is via a remote or internal application that accepts untrusted XML. Given the moderate severity and low exploitation likelihood, the risk warrants timely mitigation.