XML External Entity injection in FHIR - CVE-2026-55471
Published: July 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and perform server-side request forgery.
The vulnerability exists due to improper restriction of xml external entity reference in XsltUtilities.saxonTransform when processing attacker-influenced XML documents or referenced external entities during XSLT transformation. A remote attacker can supply a crafted XML document or influence an external entity reference to disclose sensitive information and perform server-side request forgery.
The issue affects the Saxon-based transform helpers but not the sibling transform helpers that use the hardened XMLUtil factory. Exploitation may occur when the XML source, embedded DTD, or referenced stylesheet is attacker-controlled or can be modified in transit.