CVE-2026-73235
FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
CVE-2026-73235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-56933
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
EUVD-2026-56933- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
NVD
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
CVE-2026-73235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
CVE-2026-73235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-73235
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
DEBIAN-CVE-2026-73235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-73235
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.
- Record
UBUNTU-CVE-2026-73235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freecadDebian:12 |
before 0.20.2+dfsg1-4+deb12u1, plus listed versions 0.20.2+dfsg1-4 |
0.20.2+dfsg1-4+deb12u1 |
freecadDebian:13 |
before 1.0.0+dfsg-8+deb13u3, plus listed versions 1.0.0+dfsg-81.0.0+dfsg-8+deb13u11.0.0+dfsg-8+deb13u2 |
1.0.0+dfsg-8+deb13u3 |
freecadDebian:14 |
before 1.1.3+dfsg-1, plus listed versions 1.0.0+dfsg-81.0.2+dfsg-11.0.2+dfsg-21.0.2+dfsg-31.0.2+dfsg-4 Show 11 moreShow less1.0.2+dfsg-51.0.2+dfsg-61.0.2+dfsg-71.0.2+dfsg-8~exp11.1.0+dfsg-11.1.0+dfsg-21.1.0+dfsg-2~exp11.1.1+dfsg-11.1.1+dfsg-21.1.1+dfsg-2~exp11.1.1+dfsg-3 |
1.1.3+dfsg-1 |
freecadUbuntu:16.04:LTS |
All versions, plus listed versions 0.14.3702+dfsg-40.15.4671+dfsg1-10.15.4671+dfsg1-20.15.4671+dfsg1-30.15.4671+dfsg1-4 |
None known |
freecadUbuntu:18.04:LTS |
All versions, plus listed versions 0.16+dfsg2-30.16+dfsg2-3build30.16.6712+dfsg1-10.16.6712+dfsg1-1ubuntu10.16.6712+dfsg1-1ubuntu2 |
None known |
freecadUbuntu:20.04:LTS |
All versions, plus listed versions 0.18.3+dfsg1-10.18.3+dfsg1-40.18.4+dfsg1-10.18.4+dfsg1-2~build10.18.4+dfsg1-2 Show 4 moreShow less0.18.4+dfsg1-2ubuntu80.18.4+dfsg2-1ubuntu10.18.4+dfsg2-1ubuntu20.18.4+dfsg2-1ubuntu4 |
None known |
freecadUbuntu:22.04:LTS |
All versions, plus listed versions 0.19.1+dfsg1-20.19.2+dfsg1-30.19.2+dfsg1-3ubuntu1 |
None known |
freecadUbuntu:26.10 |
All versions, plus listed versions 1.1.1+dfsg-31.1.1+dfsg-3build11.1.3+dfsg-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-73235 is a medium vulnerability (CVSS 6.1) in Freecad, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in freecad 0.20.2+dfsg1-4+deb12u1.
References
github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49