CVE-2026-82880: Improper Restriction of XML External Entity Reference in yacy yacy_search_server

CVE-2026-82880 is an XML external entity injection vulnerability affecting YaCy Search Server through version 1.941. The issue arises because the SVG, FreeMind, and OpenSearch parsers fail to disable external entity resolution, which allows attackers to embed malicious DOCTYPE declarations with SYSTEM entities referencing local files. When the crawler processes such documents, it can inadvertently exfiltrate local file contents into the search index, potentially exposing sensitive information. The vulnerability is remotely exploitable without authentication and requires no user interaction, resulting in high confidentiality impact. No vendor advisory or patch has been published to date.

An attacker can cause the YaCy crawler to disclose local files by submitting specially crafted documents containing external entity references. This leads to unauthorized disclosure of potentially sensitive local file contents into the searchable index. The vulnerability has a high confidentiality impact but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the processing of SVG, FreeMind, and OpenSearch document types or implement network-level controls to limit exposure. Monitor official YaCy channels for updates and patches addressing this vulnerability.