CVE-2018-1000069
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML...
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
CVE-2018-1000069- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
CVE-2018-1000069- Updated
- 2026-11-02
EUVDEUVD-2018-1822 No score
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
EUVD-2018-1822- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8hf8-chvw-73m9
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML...
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
GHSA-8hf8-chvw-73m9- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
CVE-2018-1000069- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000069
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
DEBIAN-CVE-2018-1000069- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2018-1000069
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.
- Record
UBUNTU-CVE-2018-1000069- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0210 No score
Updated freeplane packages fix security vulnerability
Wojciech Regula discovered an XML External Entity vulnerability in the XML Parser of the mindmap loader in freeplane, a Java program for working with mind maps, resulting in potential information disclosure if a malicious mind map file is opened (CVE-2018-1000069).
- Record
MGASA-2018-0210- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeplaneDebian:12 |
before 1.6.6-1 | 1.6.6-1 |
freeplaneDebian:14 |
before 1.6.6-1, plus listed versions 1.1.1-11.1.3-11.1.3-21.2.23+dfsg1-11.2.23-1 Show 15 moreShow less1.2.23-1~exp11.2.23-21.3.11-11.3.12-11.3.15-11.3.15-21.3.15-31.3.15-41.5.11-11.5.13-11.5.15-11.5.16-11.5.16-21.5.16-31.5.18-1 |
1.6.6-1 |
freeplaneDebian:7 |
before 1.1.3-2+deb7u1, plus listed versions 1.1.3-2 |
1.1.3-2+deb7u1 |
freeplaneDebian:8 |
before 1.3.12-1+deb8u1, plus listed versions 1.3.12-1 |
1.3.12-1+deb8u1 |
freeplaneDebian:9 |
before 1.5.18-1+deb9u1, plus listed versions 1.5.18-1 |
1.5.18-1+deb9u1 |
freeplaneMageia:6 |
before 1.3.15-3.1.mga6 | 1.3.15-3.1.mga6 |
freeplaneUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.15-21.3.15-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000069 is a medium vulnerability (CVSS 5.5) in Freeplane, published March 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.60%, the 85th percentile. Fixed in freeplane 1.6.6-1.