FreeCAD is a free and open-source multiplatform 3D parametric modeler. (CVE-2026-73235)
Description
FreeCAD versions prior to 1.1.2 contain a vulnerability in the XML parsing component where external entity resolution and external DTD loading are not disabled. This allows an attacker to craft a malicious .FCStd archive with a Document.xml that can read local files or initiate server-side requests when opened. The issue is fixed in version 1.1.2.
CVSS v3.1
Score 6.1medium
Affected software
pkg:deb/ubuntu/freecad?arch=source&distro=xenialpkg:deb/ubuntu/freecad?arch=source&distro=bionicpkg:deb/ubuntu/freecad?arch=source&distro=focalpkg:deb/ubuntu/freecad?arch=source&distro=jammypkg:deb/ubuntu/freecad?arch=source&distro=stonkingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeCAD, a free and open-source multiplatform 3D parametric modeler, has a vulnerability (CVE-2026-73235) in versions before 1.1.2 related to insecure XML parsing. The Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() does not disable default external entity resolution or external DTD loading. When Document::restore() opens a crafted Document.xml from a malicious .FCStd archive, external entities can be exploited to read local files via the file URI scheme or trigger server-side HTTP requests. This can lead to disclosure of local files (confidentiality impact) and limited integrity impact. The vulnerability is resolved in FreeCAD version 1.1.2.
Potential Impact
An attacker who can supply a crafted .FCStd archive can exploit the XML external entity (XXE) vulnerability to read local files on the victim's system or cause the application to make server-side HTTP requests. This results in a high confidentiality impact, limited integrity impact, and no availability impact. The vulnerability requires user interaction (opening the malicious file) and local access to the file.
Mitigation Recommendations
Upgrade FreeCAD to version 1.1.2 or later, where the vulnerability is fixed by disabling external entity resolution and external DTD loading in the XML parser. Users should avoid opening untrusted .FCStd files until patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-73235
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:26.10"]
- Cvss Version
- 3.1
Threat ID: 6ad3f5882cdf04f6566621b1
Added to database: 10/17/2026, 22:24:08 UTC
Last enriched: 10/17/2026, 23:47:16 UTC
Last updated: 10/17/2026, 23:47:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.