XXE in SabreDAV
High severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Mar 31, 2025
Package
Affected versions
>= 1.6.0, < 1.7.11
>= 1.8.0, < 1.8.9
Patched versions
1.7.11
1.8.9
Description
Published by the National Vulnerability Database
Jun 4, 2014
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Jul 7, 2023
Last updated
Mar 31, 2025
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
References