Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability

HIGH 7.5CVE-2024-28168 · GHSA-jqfv-jrvq-95jm · Published 09/10/2024 · updated 17/06/2026

In short

CVE-2024-28168 is a HIGH (CVSS 7.5) vulnerability affecting org.apache.xmlgraphics:fop-core, formatting objects processor (apache).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 64.1% of all vulnerabilities.
Fix: update to 2.10 or later.

Package	Affected versions	Patched versions
org.apache.xmlgraphics:fop-core Maven	`< 2.10`	`2.10`
formatting objects processor apache	`= 2.9`	No fix yet

Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: 2.9.

Users are recommended to upgrade to version 2.10, which fixes the issue.

NVD description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-28168 · ADVISORY
apache/xmlgraphics-fop commit d96ba9a · WEB
apache/xmlgraphics-fop · PACKAGE
issues.apache.org/jira/browse/FOP-3168 · WEB
xmlgraphics.apache.org/security.html · WEB
openwall.com/lists/oss-security/2024/10/09/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free