CVE-2025-52162 is an XML External Entity (XXE) vulnerability affecting agorum Software GmbH's agorum core open versions 11.9.2 and 11.10.1. The vulnerability is located in the RSSReader endpoint, where processing of XML input does not properly restrict external entity references. This flaw enables attackers to craft malicious XML payloads that can lead to unauthorized disclosure of sensitive information. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no impact on availability. No official patch or remediation guidance is provided in the available data.

Successful exploitation of this XXE vulnerability can lead to unauthorized access to sensitive data within the affected system. The confidentiality and integrity of data processed by the RSSReader endpoint may be compromised. There is no indication of impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or monitoring XML input to the RSSReader endpoint to detect or block malicious payloads. Avoid exposing this endpoint to untrusted sources where possible.