HAPI FHIR versions before 6.9.10 in the org.hl7.fhir.core module contain an XML External Entity (XXE) vulnerability (CWE-611) due to the use of net.sf.saxon.TransformerFactoryImpl without setting ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions. This allows attackers who can control or tamper with the XML being transformed to perform XXE attacks, potentially disclosing local files or causing blind XXE or SSRF to arbitrary URLs reachable from the host. The vulnerability is addressed by restricting these external entity accesses in version 6.9.10.

An attacker able to influence XML input to the vulnerable transformation method can exploit this flaw to read local files on the host system or cause the application to make network requests to arbitrary URLs, potentially leading to information disclosure or server-side request forgery. The CVSS 4.0 score of 8.7 indicates high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

A fix is available in HAPI FHIR version 6.9.10. Users should upgrade to version 6.9.10 or later to mitigate this vulnerability. No other vendor advisories indicate alternative mitigations or that no action is required.