This vulnerability (CWE-611) in Jaspersoft JasperReports Server arises from improper restriction of XML external entity references, enabling unauthenticated remote attackers to exploit XML parsing. It affects versions 9.0.0 and 10.0.0 prior to their respective hotfixes HF-9 and HF-10. The issue is publicly known and assigned a critical CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity. The vendor has published the vulnerability but has not yet provided official remediation or patch details.

The vulnerability allows unauthenticated remote attackers to exploit XML external entity processing, potentially leading to disclosure of sensitive information or disruption of service. The critical CVSS score indicates a severe impact on confidentiality and integrity with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not provided an official fix or temporary mitigation at this time. Users should monitor Jaspersoft advisories for hotfix releases HF-9 and HF-10 addressing this issue.