CVE-2026-54640— OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Quick assessment
Affected
openremote openremote
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenRemote 是一个开源的物联网（IoT）平台。在版本 1.24.2 之前， 中的 方法在解析经认证用户上传的 ETS 项目 ZIP 文件中的 时，使用了允许外部实体解析的 Saxon 和 解析器。这一对 CVE-2026-40882 漏洞的不完全修复，导致 KNX 处理程序未得到充分保护，而并行的 Velbus 处理程序已进行加固。因此，普通领域用户仍可读取 JVM 进程可访问的文件，或发起服务器端请求。该问题已在版本 1.24.2 中修复。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| io.openremote | openremote-manager | < 1.24.2 |
affected |
| openremote | openremote | < 1.24.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54640
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Source: CVE Program / CVE List V5
Vulnerability Description
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openremote | openremote | < 1.24.2 | - |
|
| io.openremote | openremote-manager | < 1.24.2 | - |
|
II. Public POCs for CVE-2026-54640
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54640
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54640 (1)
Vendor Advisories for CVE-2026-54640 (1)
Vendor Pages for CVE-2026-54640 (1)
-
🔗 Release 1.24.2 · openremote/core · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: openremote
-
CVE-2026-54641
OpenRemote: Cross-Realm User Information Disclosure in UserR -
CVE-2026-49439
OpenRemote read-only asset users can write predicted datapoi -
CVE-2026-81679
OpenRemote before 1.28.0 Cross-Realm Information Disclosure -
CVE-2026-73616
OpenRemote Notification Delete Cross-Realm Insecure Direct O -
CVE-2026-67310
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
Same vendor: openremote
-
CVE-2026-54641
OpenRemote: Cross-Realm User Information Disclosure in UserR -
CVE-2026-49439
OpenRemote read-only asset users can write predicted datapoi -
CVE-2026-81679
OpenRemote before 1.28.0 Cross-Realm Information Disclosure -
CVE-2026-73616
OpenRemote Notification Delete Cross-Realm Insecure Direct O -
CVE-2026-67310
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
Same weakness: CWE-611
-
CVE-2026-109430
Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection -
CVE-2026-106616
ColdFusion | Improper Restriction of XML External Entity Ref -
CVE-2026-90531
Adobe Experience Manager | Improper Restriction of XML Exter -
CVE-2026-93891
Security Vulnerability identified in IBM TRIRIGA - XXE -
CVE-2026-85970
Improper XML external entity restriction in Progress MarkLog
V. Comments for CVE-2026-54640
No comments yet