XML injection in xmltodict - CVE-2025-9375

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU115761

XML injection in xmltodict - CVE-2025-9375

Published: September 18, 2025


Vulnerability identifier: #VU115761
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-9375
CWE-ID: CWE-91
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing XML data. A remote unauthenticated attacker can pass specially crafted XML data to the application and perform arbitrary actions on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

xmltodict
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
openSUSE Leap
Ubuntu
openEuler
IBM Maximo Application Suite
python-xmltodict (Ubuntu package)
python311-xmltodict
python-xmltodict
python3-xmltodict

How to mitigate CVE-2025-9375

Install updates from vendor's website.

xmltodict - update to 0.15.1
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
python-xmltodict (Ubuntu package) - addressed in versions 0.9.2-3ubuntu0.1~esm1, 0.11.0-1ubuntu0.1~esm1, 0.12.0-1ubuntu0.1~esm1, 0.12.0-2ubuntu0.1~esm1, 0.13.0-1ubuntu0.24.04.1, 0.13.0-1ubuntu0.25.04.1
python311-xmltodict - addressed in versions 0.13.0-150400.12.7.1, 0.13.0-150600.3.5.1
python-xmltodict - update to 1.0.0-1
python3-xmltodict - update to 1.0.0-1

External References

Related Security Bulletins