PT-2026-36079 · 4D · 4D Server

Marcelo Reyes · Published 2026-04-30 · Updated 2026-04-30 · CVE-2024-39847

Mitre

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-39847

Affected Products

4D Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-39847 · Security Note
• https://4d.com · Note
• https://schutzwerk.com/en/blog/schutzwerk-sa-2024-002 · Note