CVE-2018-1000639

CRITICAL 9.6CVE-2018-1000639 · Published 20/08/2018 · updated 17/06/2026

In short

CVE-2018-1000639 is a CRITICAL (CVSS 9.6) vulnerability affecting latexdraw (latexdraw project).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
latexdraw latexdraw_project	`= 4.0≤ 3.3.9`	No fix yet

Description

LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file.

References

0dd.zone/2018/08/05/LatexDraw-XXE · Exploit
arnobl/latexdraw · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free