YaCy Search Server (<= 1.941) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/yacy-search-server--1.941/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 12:00:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-82880: XML External Entity Injection in YaCy Search Serverhttps://feed.craftedsignal.io/briefs/2026-08-yacy-xxe/Mon, 31 Aug 2026 12:00:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-yacy-xxe/YaCy Search Server through 1.941 is vulnerable to XML external entity (XXE) injection, allowing attackers to exfiltrate local files into the searchable index.YaCy Search Server versions up to 1.941 contain a critical XML external entity (XXE) injection vulnerability. The flaw exists within the application's SVG, FreeMind, and OpenSearch document parsers, which fail to properly disable external entity resolution during processing. An attacker can exploit this by uploading or submitting a crafted malicious document containing a DOCTYPE declaration with a SYSTEM entity that references local files. When the YaCy crawler processes these documents, it interprets the malicious entity, resolves the reference to the local file system, and includes the contents of the targeted files within the search index. This results in the exposure of sensitive local files via the search interface, effectively allowing for unauthorized data access and potential exfiltration.

Impact

Successful exploitation of this vulnerability allows unauthorized access to arbitrary files on the system hosting the YaCy Search Server. Exposure of sensitive configuration files, credentials, or system data through the searchable index poses a high risk to organizational data confidentiality.

Recommendation

  • Upgrade to a version of YaCy Search Server beyond 1.941 that addresses the insecure XML parser configuration.
  • Review the searchable index for suspicious or unexpected file content that may indicate exploitation attempts.
  • Apply the principle of least privilege to the account running the YaCy process to limit access to sensitive files on the host system.
]]>highadvisory