The vulnerability arises from the default XPath/JAXP setup used in Mirth Connect's XML batch processing when the XPath option is enabled. Because there are no restrictions on XML entities, an attacker can craft malicious XML input to perform XXE injection. This can result in unauthorized data disclosure and denial-of-service conditions. The affected versions are from 0 up to and including 4.7.1. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Successful exploitation can lead to data exfiltration through XXE injection and denial-of-service attacks against the Mirth Connect service. The confidentiality of sensitive information can be compromised, but integrity and availability impacts are not indicated by the CVSS vector.

No patch links or vendor advisories specifying fixes are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable XML batch processing with the XPath option or apply any vendor-recommended configuration changes to restrict XML entity processing to mitigate XXE risks.