PT-2025-26231 · Powsybl · Powsybl

Adamkorcz + 1 · Published 2025-06-19 · Updated 2025-06-20 · CVE-2025-47293

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions PowSyBl versions prior to 6.7.2

Description The issue concerns an XML external entity (XXE) attack and a server-side request forgery (SSRF) attack in certain places of powsybl-core XML parsing. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader, which is considered untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users, perhaps with different privilege levels.

Recommendations For versions prior to 6.7.2, update to com.powsybl:powsybl-commons: 6.7.2 or higher to patch the issue. As a temporary workaround, consider restricting access to the com.powsybl.commons.xml.XmlReader class to minimize the risk of exploitation. Avoid allowing untrusted users to import untrusted CGMES or XIIDM network files until the issue is resolved.

Exploit

Fix

LPE

SSRF

XXE

Weakness Enumeration

CWE-918

CWE-611

Related Identifiers

CVE-2025-47293

GHSA-QPJ9-QCWX-8JV2

Affected Products

Powsybl

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47293.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-47293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47293 · Security Note
• https://osv.dev/vulnerability/GHSA-qpj9-qcwx-8jv2 · Vendor Advisory
• https://github.com/powsybl/powsybl-core/commit/e6c7c4997ae8758b54a2f23ce1a499e25113acdc · Note
• https://github.com/powsybl/powsybl-core/security/advisories/GHSA-qpj9-qcwx-8jv2 · Note
• https://github.com/powsybl/powsybl-core · Note
• https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2 · Note
• https://t.me/cvenotify/126184 · Telegram Post
• https://twitter.com/transilienceai/status/1935910880656380082 · Twitter Post
• https://twitter.com/CVEnew/status/1935815584660222052 · Twitter Post
• https://t.me/cvetracker/26592 · Telegram Post
• https://twitter.com/transilienceai/status/1935910886079615113 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1935836906660511840 · Twitter Post