CVE-2026-22006 – XSLT Server‑Side Injection via xsl:script

Program Code (Python + XSLT)

# xslt_server.py - Applies user-supplied XSLT to XML
from lxml import etree
from flask import Flask, request

app = Flask(__name__)
@app.route('/transform', methods=['POST'])
def transform():
    xml = request.form['xml']
    xslt = request.form['xslt']
    xml_doc = etree.fromstring(xml.encode())
    xslt_doc = etree.fromstring(xslt.encode())
    transform = etree.XSLT(xslt_doc)
    result = transform(xml_doc)
    return str(result)

if __name__ == '__main__':
    app.run(port=5000)

CVE-2026-22006 – XSLT Server‑Side Injection via xsl:script

Overview

An XML transformation service accepts untrusted XSLT stylesheets and applies them without disabling scripting extensions. An attacker can embed xsl:script or processor‑specific functions (e.g., PHP’s php:function) to execute arbitrary code on the server.

Vulnerability Details

• Type: Code Injection
• Impact: Remote Code Execution.
• Root Cause: The XSLT processor is configured with extension functions enabled, allowing direct calls to system commands.

Exploit Demonstration

1. Start the server:
   root@kitploit:~

   pip install flask lxml
   python xslt_server.py
   

2. Send a malicious XSLT with the XML:
   root@kitploit:~

   curl -X POST -d "xml=<root/>" --data-urlencode "[email protected]" http://localhost:5000/transform
   

The server returns the output of id.