Description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.
INFO
Published Date :
2026-04-22T20:33:23.304Z
Last Modified :
2026-04-23T13:47:07.964Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-40882 vulnerability.
| Vendors | Products |
|---|---|
| Openremote |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40882.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact