AIKIDO-2026-783925

simplesamlphp/xml-common is vulnerable to XML External Entity Injection (XXE)

XML External Entity Injection (XXE)GHSA-fqrg-5gph-5pf8 Published 3 days ago

High Risk

This Affects:

simplesamlphp/xml-common

2.7.2 - 2.7.5

Fixed in 2.7.6

2.8.0 - 2.8.1

Fixed in 2.8.2

3.0.0 - 3.0.0

Fixed in 3.0.1

Are you affected? Scan for Free

TL;DR

The DOMDocumentFactory parses XML with LIBXML_NOENT set in its default parser options, which causes libxml to resolve and substitute external entities. When an application passes an untrusted XML document such as a SAML response, assertion, or metadata through the factory, a crafted document type definition can reference external entities that are expanded during parsing. This enables XML External Entity injection that discloses local files readable by the web-server process and can trigger server-side requests to internal or external services. On PHP builds linking libxml older than 2.13.0 the factory has no LIBXML_NO_XXE fallback, so the entity substitution is unmitigated. The fix removes LIBXML_NOENT from the factory default options across the 2.7, 2.8, and 3.0 release lines so external entities are no longer substituted.

Who does this affect?

You are affected if your application feeds untrusted or externally influenced XML — for example SAML responses, assertions, or metadata — to DOMDocumentFactory (directly or via SimpleSAMLphp) on an affected release, and your PHP runtime links libxml older than 2.13.0. On those builds the default parser options include LIBXML_NOENT, so a document type definition in the input can pull in file://, network, or PHP-wrapper external entities that are expanded into the parsed document. Runtimes on libxml 2.13.0 or newer additionally set LIBXML_NO_XXE, which blocks the substitution. Upgrade to 2.7.6, 2.8.2, or 3.0.1, each of which drops LIBXML_NOENT from the default options.