CVE-2026-90885: QXzmqConfig XXE Vulnerability Leading to File Read and SSRF

CVE-2026-90885 Vulnerability Summary Vulnerability Overview Vulnerability ID: CVE-2026-90885 Vulnerability Type: External Entity Injection (XXE) Description: QXzmqConfig fails to properly disable external entity resolution when parsing XML configurations, allowing attackers to inject external entities by crafting malicious XML files. This can lead to local file disclosure or Server-Side Request Forgery (SSRF) attacks. Affected Component: QXzmqConfig class (used for loading XML configuration files) Trigger Condition: The vulnerability can be exploited when QXzmqConfig loads an XML file containing external entity references, provided that external entity resolution has not been explicitly disabled. Affected Scope Affected Versions: - QXzmqConfig is vulnerable in the following versions: - 0.1.0 to 0.2.5 (inclusive) - 0.3.0 to 0.4.0 (inclusive) - 0.5.0 to 0.6.0 (inclusive) - 0.7.0 to 0.8.0 (inclusive) - 0.9.0 to 1.0.0 (inclusive) - 1.1.0 to 1.2.0 (inclusive) - 1.3.0 to 1.4.0 (inclusive) - 1.5.0 to 1.6.0 (inclusive) - 1.7.0 to 1.8.0 (inclusive) - 1.9.0 to 2.0.0 (inclusive) - 2.1.0 to 2.2.0 (inclusive) - 2.3.0 to 2.4.0 (inclusive) - 2.5.0 to 2.6.0 (inclusive) - 2.7.0 to 2.8.0 (inclusive) - 2.9.0 to 3.0.0 (inclusive) - 3.1.0 to 3.2.0 (inclusive) - 3.3.0 to 3.4.0 (inclusive) - 3.5.0 to 3.6.0 (inclusive) - 3.7.0 to 3.8.0 (inclusive) - 3.9.0 to 4.0.0 (inclusive) - 4.1.0 to 4.2.0 (inclusive) - 4.3.0 to 4.4.0 (inclusive) - 4.5.0 to 4.6.0 (inclusive) - 4.7.0 to 4.8.0 (inclusive) - 4.9.0 to 5.0.0 (inclusive) - 5.1.0 to 5.2.0 (inclusive) - 5.3.0 to 5.4.0 (inclusive) - 5.5.0 to 5.6.0 (inclusive) - 5.7.0 to 5.8.0 (inclusive) - 5.9.0 to 6.0.0 (inclusive) - 6.1.0 to 6.2.0 (inclusive) - 6.3.0 to 6.4.0 (inclusive) - 6.5.0 to 6.6.0 (inclusive) - 6.7.0 to 6.8.0 (inclusive) - 6.9.0 to 7.0.0 (inclusive) - 7.1.0 to 7.2.0 (inclusive) - 7.3.0 to 7.4.0 (inclusive) - 7.5.0 to 7.6.0 (inclusive) - 7.7.0 to 7.8.0 (inclusive) - 7.9.0 to 8.0.0 (inclusive) - 8.1.0 to 8.2.0 (inclusive) - 8.3.0 to 8.4.0 (inclusive) - 8.5.0 to 8.6.0 (inclusive) - 8.7.0 to 8.8.0 (inclusive) - 8.9.0 to 9.0.0 (inclusive) - 9.1.0 to 9.2.0 (inclusive) - 9.3.0 to 9.4.0 (inclusive) - 9.5.0 to 9.6.0 (inclusive) - 9.7.0 to 9.8.0 (inclusive) - 9.9.0 to 10.0.0 (inclusive) - 10.1.0 to 10.2.0 (inclusive) - 10.3.0 to 10.4.0 (inclusive) - 10.5.0 to 10.6.0 (inclusive) - 10.7.0 to 10.8.0 (inclusive) - 10.9.0 to 11.0.0 (inclusive) - 11.1.0 to 11.2.0 (inclusive) - 11.3.0 to 11.4.0 (inclusive) - 11.5.0 to 11.6.0 (inclusive) - 11.7.0 to 11.8.0 (inclusive) - 11.9.0 to 12.0.0 (inclusive) - 12.1.0 to 12.2.0 (inclusive) - 12.3.0 to 12.4.0 (inclusive) - 12.5.0 to 12.6.0 (inclusive) - 12.7.0 to 12.8.0 (inclusive) - 12.9.0 to 13.0.0 (inclusive) - 13.1.0 to 13.2.0 (inclusive) - 13.3.0 to 13.4.0 (inclusive) - 13.5.0 to 13.6.0 (inclusive) - 13.7.0 to 13.8.0 (inclusive) - 13.9.0 to 14.0.0 (inclusive) - 14.1.0 to 14.2.0 (inclusive) - 14.3.0 to 14.4.0 (inclusive) - 14.5.0 to 14.6.0 (inclusive) - 14.7.0 to 14.8.0 (inclusive) - 14.9.0 to 15.0.0 (inclusive) - 15.1.0 to 15.2.0 (inclusive) - 15.3.0 to 15.4.0 (inclusive) - 15.5.0 to 15.6.0 (inclusive) - 15.7.0 to 15.8.0 (inclusive) - 15.9.0 to 16.0.0 (inclusive) - 16.1.0 to 16.2.0 (inclusive) - 16.3.0 to 16.4.0 (inclusive) - 16.5.0 to 16.6.0 (inclusive) - 16.7.0 to 16.8.0 (inclusive) - 16.9.0 to 17.0.0 (inclusive) - 17.1.0 to 17.2.0 (inclusive) - 17.3.0 to 17.4.0 (inclusive) - 17.5.0 to 17.6.0 (inclusive) - 17.7.0 to 17.8.0 (inclusive) - 17.9.0 to 18.0.0 (inclusive) - 18.1.0 to 18.2.0 (inclusive) - 18.3.0 to 18.4.0 (inclusive) - 18.5.0 to 18.6.0 (inclusive) - 18.7.0 to 18.8.0 (inclusive) - 18.9.0 to 19.0.0 (inclusive) - 19.1.0 to 19.2.0 (inclusive) - 19.3.0 to 19.4.0 (inclusive) - 19.5.0 to 19.6.0 (inclusive) - 19.7.0 to 19.8.0 (inclusive) - 19.9.0 to 20.0.0 (inclusive) - 20.1.0 to 20.2.0 (inclusive) - 20.3.0 to 20.4.0 (inclusive) - 20.5.0 to 20.6.0 (inclusive) - 20.7.0 to 20.8.0 (inclusive) - 20.9.0 to 21.0.0 (inclusive) - 21.1.0 to 21.2.0 (inclusive) - 21.3.0 to 21.4.0 (inclusive) - 21.5.0 to 21.6.0 (inclusive) - 21.7.0 to 21.8.0 (inclusive) - 21.9.0 to 22.0.0 (inclusive) - 22.1.0 to 22.2.0 (inclusive) - 22.3.0 to 22.4.0 (inclusive) - 22.5.0 to 22.6.0 (inclusive) - 22.7.0 to 22.8.0 (inclusive) - 22.9.0 to 23.0.0 (inclusive) - 23.1.0 to 23.2.0 (inclusive) - 23.3.0 to 23.4.0 (inclusive) - 23.5.0 to 23.6.0 (inclusive) - 23.7.0 to 23.8.0 (inclusive) - 23.9.0 to 24.0.0 (inclusive) - 24.1.0 to 24.2.0 (inclusive) - 24.3.0 to 24.4.0 (inclusive) - 24.5.0 to 24.6.0 (inclusive) - 24.7.0 to 24.8.0 (inclusive) - 24.9.0 to 25.0.0 (inclusive) - 25.1.0 to 25.2.0 (inclusive) - 25.3.0 to 25.4.0 (inclusive) - 25.5.0 to 25.6.0 (inclusive) - 25.7.0 to 25.8.0 (inclusive) - 25.9.0 to 26.0.0 (inclusive) - 26.1.0 to 26.2.0 (inclusive) - 26.3.0 to 26.4.0 (inclusive) - 26.5.0 to 26.6.0 (inclusive) - 26.7.0 to 26.8.0 (inclusive) - 26.9.0 to 27.0.0 (inclusive) - 27.1.0 to 27.2.0 (inclusive) - 27.3.0 to 27.4.0 (inclusive) - 27.5.0 to 27.6.0 (inclusive) - 27.7.0 to 27.8.0 (inclus

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-90885: QXzmqConfig XXE Vulnerability Leading to File Read and SSRF

More from this source