The vulnerability arises because Jaxp13XPathTemplate evaluates XPath expressions for StreamSource and SAXSource inputs using a code path that relies on the JDK's default DocumentBuilderFactory behavior rather than Spring's hardened parser configuration. This improper restriction of XML External Entity references (CWE-611) can expose applications that process untrusted XML payloads to XXE attacks. Affected versions include Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. The CVSS v3.1 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files or resources accessible to the application by leveraging XML External Entity processing during XPath evaluation. The confidentiality of sensitive information may be compromised. Integrity impact is limited, and availability is not affected according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, avoid evaluating XPath expressions against untrusted XML inputs or implement custom hardened XML parser configurations to disable external entity resolution.