CVE-2026-11112 – XXE via SVG Image Upload

Program Code (Python Flask + XML parser)

# xxe_upload_server.py - Uploads SVG, renders with lxml resolving entities
from flask import Flask, request
from lxml import etree

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_svg():
    svg_data = request.data
    # Vulnerable: parses with entity resolution enabled
    parser = etree.XMLParser(resolve_entities=True, no_network=False)
    doc = etree.fromstring(svg_data, parser)
    # Extract something from SVG
    return etree.tostring(doc)

if __name__ == '__main__':
    app.run(port=5000)

CVE-2026-11112 – XML External Entity (XXE) Injection via SVG Upload

Overview

A web application accepts SVG image uploads and parses them with a vulnerable XML parser that has external entity resolution enabled. An attacker can embed an XXE payload to read local files, perform SSRF, or cause denial of service.

Vulnerability Details

• Type: XXE Injection
• Impact: Arbitrary file read, internal network scanning.
• Root Cause: The XML parser is configured with resolve_entities=True and network access, allowing expansion of external entities.

Exploit Demonstration

1. Start the upload server:
   root@kitploit:~

   pip install flask lxml
   python xxe_upload_server.py
   

2. Run the exploit:
   root@kitploit:~

   python exploit_xxe_svg.py