Vulnerability Description
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML(...) or ViewXmlUtils.fromXML(...), unsafe XML processing can lead to file disclosure or SSRF.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://gist.github.com/Misakim1/859c3eb9ced699089ee0747dae9bedc1
- https://github.com/oinone/oinone-pamirs
- https://www.oinone.top/changelog
FAQ
What is CVE-2026-39053?
CVE-2026-39053 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils....
How severe is CVE-2026-39053?
CVE-2026-39053 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-39053?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.