目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-66295— Saxy 编码器 XML 注入漏洞

一分钟漏洞结论

影响对象
qcam saxy
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Saxy 的 XML 编码器会将处理指令（processing instruction）的目标（target）和内容原样写入输出文档，既未进行验证也未做转义处理。该编码器通过将这两个字段拼接在 和 之间来构建处理指令结构，因此这两个字段均未受到 XML 规范所施加的约束检查。 由于 用于终止处理指令，若目标或内容中包含该序列，则会在攻击者指定的位置提前结束该结构。攻击者在该序列之后写入的所有内容都将被作为普通标记（markup）在文档层级输出，从而允许将任意元素、属性以及更多处理指令注入到序列化的文档中。通过追加一

CVSS 2.1 · Low

影响版本矩阵 2

厂商产品 版本范围状态
qcam saxy 0.7.0< 1.7.0 affected
7266632e9407842f28ffac254c56dc41210a5690< 4aeb80e2acc318f57bd7453ad2eafd59101a90e0 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-66295 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection
来源: CVE Program / CVE List V5
Vulnerability Description
Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked against the constraints the XML specification places on it. Because ?> terminates a processing instruction, a target or content value containing that sequence closes the construct at a position the attacker chooses. Everything the attacker writes after it is emitted as ordinary markup at document level, which allows arbitrary elements, attributes, and further processing instructions to be injected into the serialized document. Appending a matching <? keeps the encoder's own terminator well-formed, so the result still parses and the injection is silent rather than a visible corruption. The target is additionally unconstrained by the XML Name production, which permits injection before the remainder of the processing instruction. The result is XML injection into a serialized document: the tree the application asks Saxy to encode and the tree a downstream parser reads back are no longer the same. Character data, attribute values, and comments are all escaped by the encoder, so processing instructions are the one construct that passes user bytes through untouched. Since Saxy.XML.processing_instruction/2 is a documented public builder, an application inherits the flaw without misusing the API. The consequences depend on what consumes the XML: forged records in a feed or export read by another system, injected stylesheet or rendering directives, or active content where the output is served to a browser as XML or SVG. This issue affects saxy: from 0.7.0 before 1.7.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
qcam saxy 0.7.0 ~ 1.7.0 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*
qcam saxy 7266632e9407842f28ffac254c56dc41210a5690 ~ 4aeb80e2acc318f57bd7453ad2eafd59101a90e0 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-66295 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-66295 的情报信息

请登录查看更多情报信息。

CVE-2026-66295 其他参考 (5)

同批安全公告 · qcam · 2026-11-06 · 共 3 条

CVE-2026-66294 2.1 LOW Saxy XML 注入漏洞（未转义 CDATA 结束符）
CVE-2026-66293 2.1 LOW Saxy 编码器 XML 注释注入漏洞

IV. Related Vulnerabilities

Same product: saxy
Same vendor: qcam
Same weakness: CWE-91