CVE-2025-47293

Description

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.

Reserved 2025-05-05 | Published 2025-06-19 | Updated 2025-06-19 | Assigner GitHub_M

Problem types

CWE-611: Improper Restriction of XML External Entity Reference

CWE-918: Server-Side Request Forgery (SSRF)

Product status

< 6.7.2
affected

References

github.com/...l-core/security/advisories/GHSA-qpj9-qcwx-8jv2

github.com/...ommit/e6c7c4997ae8758b54a2f23ce1a499e25113acdc

github.com/powsybl/powsybl-core/releases/tag/v6.7.2

cve.org (CVE-2025-47293)

nvd.nist.gov (CVE-2025-47293)

Download JSON