XML External Entity injection in Asterisk Open Source and Certified Asterisk - CVE-2026-23739
Published: February 6, 2026
Vulnerability identifier: #VU122440
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]
CVE-ID: CVE-2026-23739
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input within the ast_xml_open() function in xml.c. A remote privileged user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
The vendor underlines that Asterisk currently doesn't allow untrusted or user-supplied XML to be used but a fix should be made in case that changes in the future.
Affected software
Asterisk Open Source
Certified Asterisk
Certified Asterisk
How to mitigate CVE-2026-23739
Install updates from vendor's website.
Asterisk Open Source - addressed in versions 20.18.2, 21.12.1, 22.8.2, 23.2.2
Certified Asterisk - update to 20.7-cert9
Certified Asterisk - update to 20.7-cert9