This vulnerability (CWE-611) in Lobster_pro's XML parser allows unauthenticated remote attackers to leverage XML External Entity injection to access sensitive files on the server and connected network shares. Additionally, attackers can induce the application to send HTTP GET requests to arbitrary services, potentially enabling further information gathering or network reconnaissance. The issue affects versions prior to 4.12.6-GA. The CVSS 4.0 base score is 7.7, reflecting high severity with network attack vector, no privileges or user interaction required, and high scope impact.

Successful exploitation grants attackers read access to files on the application server and adjacent network shares, potentially exposing sensitive data. It also allows attackers to perform HTTP GET requests to arbitrary services, which could be used for internal network scanning or accessing internal resources. The vulnerability does not require authentication or user interaction, increasing its risk. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is indicated, users should monitor vendor communications closely and apply updates once available. Until then, consider restricting XML input sources or disabling external entity processing if configurable in the application to mitigate risk.