In libxml2 versions prior to 2.15.4, the XInclude functions xmlXIncludeProcess and xmlXIncludeProcessTree do not forward the parser flags that are set in the original parse context. Because of this omission, optional flags such as XML_PARSE_NONET are ignored when loading included resources. This weakness, classified as CWE-669, allows a user to bypass network restrictions and have libxml2 fetch data from the internet. If the included resource is controlled by an attacker, the library can be exploited for XML External Entity injection, Server Side Request Forgery, or a denial of service by loading a slow or malicious resource.

The vulnerability affects the xmlsoft libxml2 library. Any installation using a version older than 2.15.4 is susceptible, while the release of version 2.15.4 and later resolves the issue. The library is widely used in applications that process XML data, including web servers, XML parsers, and configuration tools.

The CVSS base score is 5.6, indicating moderate severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply XML documents that trigger XInclude processing in a context where the XML_PARSE_NONET flag is not enforced. This suggests the attack vector is most likely local or at least requires the attacker to influence the XML being parsed by a vulnerable application. While no public exploits are known, the ability to load arbitrary external resources raises significant concern for untrusted input scenarios. The vulnerability should be treated as a moderate risk until patched.