Read the docs
TI-2018-16057 Aliases CVE-2018-1000835GHSA-9qcx-vmqv-xpff

KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in…

Priority MEDIUM 46CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

Why it matters now

EPSS 0.01799 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta1:*:*:*:*:*:*2.5.0.0 beta1VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta10:*:*:*:*:*:*2.5.0.0 beta10VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta11:*:*:*:*:*:*2.5.0.0 beta11VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta12:*:*:*:*:*:*2.5.0.0 beta12VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta13:*:*:*:*:*:*2.5.0.0 beta13VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta14:*:*:*:*:*:*2.5.0.0 beta14VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta15:*:*:*:*:*:*2.5.0.0 beta15VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta16:*:*:*:*:*:*2.5.0.0 beta16VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta17:*:*:*:*:*:*2.5.0.0 beta17VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta2:*:*:*:*:*:*2.5.0.0 beta2VulnerableKeepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta1:*:*:*:*:*:* Versions 2.5.0.0 beta1 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta10:*:*:*:*:*:* Versions 2.5.0.0 beta10 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta11:*:*:*:*:*:* Versions 2.5.0.0 beta11 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta12:*:*:*:*:*:* Versions 2.5.0.0 beta12 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta13:*:*:*:*:*:* Versions 2.5.0.0 beta13 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta14:*:*:*:*:*:* Versions 2.5.0.0 beta14 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta15:*:*:*:*:*:* Versions 2.5.0.0 beta15 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta16:*:*:*:*:*:* Versions 2.5.0.0 beta16 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta17:*:*:*:*:*:* Versions 2.5.0.0 beta17 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta2:*:*:*:*:*:* Versions 2.5.0.0 beta2 Vulnerable ·Keepassdx
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta3:*:*:*:*:*:*2.5.0.0 beta3VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta4:*:*:*:*:*:*2.5.0.0 beta4VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta5:*:*:*:*:*:*2.5.0.0 beta5VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta6:*:*:*:*:*:*2.5.0.0 beta6VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta7:*:*:*:*:*:*2.5.0.0 beta7VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta8:*:*:*:*:*:*2.5.0.0 beta8VulnerableKeepassdx
cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta9:*:*:*:*:*:*2.5.0.0 beta9VulnerableKeepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta3:*:*:*:*:*:* Versions 2.5.0.0 beta3 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta4:*:*:*:*:*:* Versions 2.5.0.0 beta4 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta5:*:*:*:*:*:* Versions 2.5.0.0 beta5 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta6:*:*:*:*:*:* Versions 2.5.0.0 beta6 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta7:*:*:*:*:*:* Versions 2.5.0.0 beta7 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta8:*:*:*:*:*:* Versions 2.5.0.0 beta8 Vulnerable ·Keepassdx
  • cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta9:*:*:*:*:*:* Versions 2.5.0.0 beta9 Vulnerable ·Keepassdx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000835
  2. 2026-10-03 Alias added: GHSA-9qcx-vmqv-xpff

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences