GHSA-7v6w-c3f4-9wpq: OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
OpenRemote's KNX asset import handler contains an incomplete fix for CVE-2026-40882, resulting in an XML External Entity (XXE) vulnerability. The KNXProtocol.startAssetImport() method processes user-uploaded ETS project ZIP files using Saxon XSLT and XMLInputFactory without proper XXE protections. This allows any authenticated user to read arbitrary files from the server filesystem. The Velbus asset import handler was properly patched, but the KNX handler remains vulnerable due to missing XXE mitigation features in its XML parsing code.
AI Analysis
Technical Summary
The vulnerability arises because the KNXProtocol asset import handler in OpenRemote does not apply the XXE protections introduced in the Velbus handler fix for CVE-2026-40882. Specifically, the KNXProtocol uses Saxon TransformerFactoryImpl and XMLInputFactory.newInstance() to parse user-controlled XML data without disabling DTD processing or external entity resolution. This allows authenticated users to craft malicious XML that causes the server to read arbitrary files, such as /etc/passwd or cloud credential files. The incomplete patch means the KNX handler remains exploitable despite the prior fix in a parallel component.
Potential Impact
An authenticated user with low privileges can exploit this vulnerability to read arbitrary files on the server hosting OpenRemote. This can lead to disclosure of sensitive information including system files and credentials, potentially facilitating further attacks or data breaches. The vulnerability affects confidentiality (high impact), with limited integrity and availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the asset import functionality to trusted users only. Monitor vendor communications for updates addressing the incomplete patch in the KNXProtocol component. Do not rely on the existing fix for the Velbus handler as it does not protect the KNX handler.
GHSA-7v6w-c3f4-9wpq: OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Description
OpenRemote's KNX asset import handler contains an incomplete fix for CVE-2026-40882, resulting in an XML External Entity (XXE) vulnerability. The KNXProtocol.startAssetImport() method processes user-uploaded ETS project ZIP files using Saxon XSLT and XMLInputFactory without proper XXE protections. This allows any authenticated user to read arbitrary files from the server filesystem. The Velbus asset import handler was properly patched, but the KNX handler remains vulnerable due to missing XXE mitigation features in its XML parsing code.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the KNXProtocol asset import handler in OpenRemote does not apply the XXE protections introduced in the Velbus handler fix for CVE-2026-40882. Specifically, the KNXProtocol uses Saxon TransformerFactoryImpl and XMLInputFactory.newInstance() to parse user-controlled XML data without disabling DTD processing or external entity resolution. This allows authenticated users to craft malicious XML that causes the server to read arbitrary files, such as /etc/passwd or cloud credential files. The incomplete patch means the KNX handler remains exploitable despite the prior fix in a parallel component.
Potential Impact
An authenticated user with low privileges can exploit this vulnerability to read arbitrary files on the server hosting OpenRemote. This can lead to disclosure of sensitive information including system files and credentials, potentially facilitating further attacks or data breaches. The vulnerability affects confidentiality (high impact), with limited integrity and availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the asset import functionality to trusted users only. Monitor vendor communications for updates addressing the incomplete patch in the KNXProtocol component. Do not rely on the existing fix for the Velbus handler as it does not protect the KNX handler.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7v6w-c3f4-9wpq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54640"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4c340527e9c797195f648c
Added to database: 07/06/2026, 23:02:29 UTC
Last enriched: 07/06/2026, 23:13:45 UTC
Last updated: 07/06/2026, 23:13:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.