Threat database

CVE-2026-32251 is a critical XML External Entity (XXE) vulnerability in tolgee-platform versions prior to 3.166.3. The issue arises because the XML parsers used for importing Android XML and . resx translation files do not disable external entity processing. An authenticated user with permission to import translation files can exploit this flaw to read arbitrary files on the server and perform server-side requests to internal services, potentially exposing sensitive data and internal network resources. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity, and requires no user interaction or privileges beyond authentication. Although no known exploits are currently reported in the wild, the impact could be severe if weaponized.