PT-2025-16391 · Teigarage · Teigarage

Xbow-Security · Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-31497

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TEIGarage versions prior to 1.2.4

Description The Document Conversion Service in TEIGarage contains a critical XML External Entity (XXE) Injection issue in its document conversion functionality. This allows an attacker to read arbitrary files from the server's filesystem, potentially exposing configuration files, credentials, or other confidential information. Depending on the server configuration, this could also be used to perform server-side request forgery (SSRF) attacks.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 to resolve the issue. As a temporary workaround, consider disabling external entity processing in the XML parser by setting the appropriate security features, such as XMLConstants.FEATURE SECURE PROCESSING.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-31497

GHSA-W2HQ-3CJC-2X55

Affected Products

Teigarage

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31497.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-31497 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31497 · Vendor Advisory
• https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55 · Note
• https://twitter.com/CVEnew/status/1912243267758064000 · Twitter Post
• https://t.me/cvedetector/23008 · Telegram Post