XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
Priority HIGH 77CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 6 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.82392 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xstream (x-stream): 1.4.15com.thoughtworks.xstream:xstream (Maven): 1.4.15Red Hat: 6 advisoriesRed Hat: 6 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.15 | 1.4.15 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.15 | 1.4.15 | Patch available | GHSA-jfvx-7wrx-43fh |
- xstream VendorXStream Affected before 1.4.15 Fixed in 1.4.15 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.15 Fixed in 1.4.15 Patch available GHSA-jfvx-7wrx-43fh
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* | before 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | before 1.4.15 | Vulnerable | XStream |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions before 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.15 Vulnerable ·XStream
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.15
- Fix · GHSA-jfvx-7wrx-43fh com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.15 Advisory →
Red Hat 6 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
Show 3 more Red Hat advisories
- RHSA-2021:2476 Released 2021-06-17 · Red Hat rating ModerateRed Hat Decision Manager 7.11.0 security update
- RHDM 7.11.0
- RHSA-2021:2475 Released 2021-06-17 · Red Hat rating ModerateRed Hat Process Automation Manager 7.11.0 security update
- RHPAM 7.11.0
- RHSA-2021:2139 Released 2021-05-26 · Red Hat rating CriticalRed Hat Data Grid 8.2.0 security update
- Red Hat Data Grid 8.2.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| RHDM 7.11.0 | Fixed | RHSA-2021:2476 |
| RHPAM 7.11.0 | Fixed | RHSA-2021:2475 |
| Red Hat Data Grid 8.2.0 | Fixed | RHSA-2021:2139 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26259
- 2026-10-03 Alias added: GHSA-jfvx-7wrx-43fh
- 2026-10-07 CISA SSVC decision points changed
References
Advisory 8
- https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh
- [debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update
- DSA-4828
- https://security.netapp.com/advisory/ntap-20210409-0005/
- FEDORA-2021-fbad11014a
- FEDORA-2021-d894ca87dc
- FEDORA-2021-5e376c0ed9
- https://nvd.nist.gov/vuln/detail/CVE-2020-26259
Other 7
- [struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259
- https://github.com/x-stream/xstream
- https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://security.netapp.com/advisory/ntap-20210409-0005
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
Sources
- CVE-2020-26259 · CVE Program
- CVE-2020-26259 · NVD
- FIRST EPSS
- GHSA-jfvx-7wrx-43fh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26259 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences