Read the docs
TI-2017-03661 Aliases CVE-2017-5661GHSA-5hg8-r9vq-gjqp

XML external entity injection in Apache FOP

Priority LOW 37CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

Why it matters now

EPSS 0.02519 84th percentileScored 2026-11-07
Fix Partial Apache FOP (Apache Software Foundation): 2.2org.apache.xmlgraphics:fop (Maven): 2.2Red Hat: 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache FOPbefore 2.22.2Patch availableCNA
—org.apache.xmlgraphics:fop (Maven)before 2.22.2Patch availableGHSA-5hg8-r9vq-gjqp
  • Apache FOP VendorApache Affected before 2.2 Fixed in 2.2 Patch available CNA
  • org.apache.xmlgraphics:fop (Maven) Vendor— Affected before 2.2 Fixed in 2.2 Patch available GHSA-5hg8-r9vq-gjqp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:formatting_objects_processor:*:*:*:*:*:*:*:*up to 2.1VulnerableApache
  • cpe:2.3:a:apache:formatting_objects_processor:*:*:*:*:*:*:*:* Versions up to 2.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache FOP (Apache Software Foundation) Fixed in 2.2
  • Fix · GHSA-5hg8-r9vq-gjqp org.apache.xmlgraphics:fop (Maven) Fixed in 2.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5661
  2. 2026-10-03 Alias added: GHSA-5hg8-r9vq-gjqp

References

Patch 1

Advisory 2

Other 1

  • TI-2024-18746 Apache XML Graphics FOP: XML External Entity (XXE) Processing CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences