CVE-2026-92001

6.1 MEDIUM

Published 2026-09-23 · Updated 2026-09-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-776

All references

https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr
http://www.openwall.com/lists/oss-security/2026/09/23/15

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.