CVE-2023-28150

CRITICAL 9.8CVE-2023-28150 · Published 24/03/2023 · updated 17/06/2026

In short

CVE-2023-28150 is a CRITICAL (CVSS 9.8) vulnerability affecting jodf (independentsoft).
Chance of exploitation in the next 30 days (EPSS): 0.75%, higher than 55.0% of all vulnerabilities.
Fix: update to 1.1.110 or later.

Package	Affected versions	Patched versions
jodf independentsoft	`< 1.1.110`	`1.1.110`

Description

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

References

cds.thalesgroup.com/en/tcs-cert/CVE-2023-28150
excellium-services.com/cert-xlm-advisory/CVE-2023-28150 · Third Party Advisory
independentsoft.de/jword/index.html · Not Applicable

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free