This vulnerability (CWE-611) affects the XML parser functionality of Lobster_pro before version 4.12.6-GA. It allows unauthenticated remote attackers to leverage XML External Entity injection to access sensitive files on the server and connected network shares, and to initiate HTTP GET requests to arbitrary services. The CVSS 4.0 base score is 7.7, reflecting network attack vector, no required privileges or user interaction, and high scope impact with some confidentiality impact. The vendor has not yet provided an official fix or advisory, and no patch links are available.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the application server and adjacent network shares. Additionally, attackers can perform HTTP GET requests to arbitrary services, potentially enabling further network reconnaissance or indirect attacks. The vulnerability does not require authentication or user interaction, increasing its risk. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable service, applying network-level controls to limit outbound HTTP requests from the server, and monitoring for unusual XML payloads. Avoid exposing the affected Lobster_pro versions to untrusted networks.