PT-2026-3629 · Opensagres · Xdocreport

Published 2026-01-20 · Updated 2026-02-03 · CVE-2025-65482

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions opensagres XDocReport versions 0.9.2 through 2.0.3

Description An XML External Entity (XXE) issue exists in opensagres XDocReport. Successful exploitation allows attackers to execute arbitrary code by uploading a specially crafted .docx file. The issue is related to the processing of XML data within the application.

Recommendations Update opensagres XDocReport to a version later than 2.0.3.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-65482

GHSA-7JC7-G598-2P64

Affected Products

Xdocreport

References · 14

• 🔥 https://github.com/AT190510-Cuong/CVE-2025-65482-XXE- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65482 · Security Note
• https://osv.dev/vulnerability/GHSA-7jc7-g598-2p64 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65482 · Vendor Advisory
• https://github.com/opensagres/xdocreport · Note
• https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332 · Note
• https://hackmd.io/@cuongnh/r1B7B8fJ-g · Note
• https://twitter.com/CVEnew/status/2013641584206659892 · Twitter Post
• https://twitter.com/pulsepatchio/status/2014348217203237244 · Twitter Post
• https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing · Note
• https://twitter.com/TheHackerWire/status/2014008290334912691 · Twitter Post
• https://t.me/cveNotify/149402 · Telegram Post
• https://t.me/cveNotify/150794 · Telegram Post
• https://hackmd.io/@cuongnh/rkJPCgSy-l · Note