CVE-2026-82880: XML External Entity Injection in YaCy Search Server

YaCy Search Server versions up to 1.941 contain a critical XML external entity (XXE) injection vulnerability. The flaw exists within the application's SVG, FreeMind, and OpenSearch document parsers, which fail to properly disable external entity resolution during processing. An attacker can exploit this by uploading or submitting a crafted malicious document containing a DOCTYPE declaration with a SYSTEM entity that references local files. When the YaCy crawler processes these documents, it interprets the malicious entity, resolves the reference to the local file system, and includes the contents of the targeted files within the search index. This results in the exposure of sensitive local files via the search interface, effectively allowing for unauthorized data access and potential exfiltration.

Impact

Successful exploitation of this vulnerability allows unauthorized access to arbitrary files on the system hosting the YaCy Search Server. Exposure of sensitive configuration files, credentials, or system data through the searchable index poses a high risk to organizational data confidentiality.

Recommendation

• Upgrade to a version of YaCy Search Server beyond 1.941 that addresses the insecure XML parser configuration.
• Review the searchable index for suspicious or unexpected file content that may indicate exploitation attempts.
• Apply the principle of least privilege to the account running the YaCy process to limit access to sensitive files on the host system.