Improper restriction of recursive entity references in DTDs, also known as XML entity expansion, is present in Apache Sling XSS before version 2.4.12. The flaw allows an attacker to craft XML payloads that contain deeply nested or recursive entities, causing the parser to expand them unchecked. When the expanded entities are incorporated into a response, they can embed malicious script that is executed in the victim’s browser, leading to cross‑site scripting. The weakness is identified as CWE‑776.

Affected products are Apache Sling XSS from the Apache Software Foundation. Versions before 2.4.12 are vulnerable; upgrading to 2.4.12 or later eliminates the issue.

The CVSS score of 6.1, the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of current exploitation. The impact is moderate because the vulnerability enables XSS, but it requires that the target parses malicious XML. Based on the description, the likely attack vector involves sending a specially crafted XML document to a Sling endpoint that parses DTDs, which is inferred from the need for recursive entity processing.