AIKIDO-2026-783925

simplesamlphp/xml-common is vulnerable to XML External Entity Injection (XXE)

CVE-2026-104839Published Aug 4, 2026

CVE Score

High

XML External Entity Injection (XXE)

TL;DR

The DOMDocumentFactory parses XML with LIBXML_NOENT set in its default parser options, which causes libxml to resolve and substitute external entities. When an application passes an untrusted XML document such as a SAML response, assertion, or metadata through the factory, a crafted document type definition can reference external entities that are expanded during parsing. This enables XML External Entity injection that discloses local files readable by the web-server process and can trigger server-side requests to internal or external services. On PHP builds linking libxml older than 2.13.0 the factory has no LIBXML_NO_XXE fallback, so the entity substitution is unmitigated. The fix removes LIBXML_NOENT from the factory default options across the 2.7, 2.8, and 3.0 release lines so external entities are no longer substituted.

How do I fix this?

Upgrade the simplesamlphp/xml-common library to the patch version.

Who does this affect?

You are affected if your application feeds untrusted or externally influenced XML — for example SAML responses, assertions, or metadata — to DOMDocumentFactory (directly or via SimpleSAMLphp) on an affected release, and your PHP runtime links libxml older than 2.13.0. On those builds the default parser options include LIBXML_NOENT, so a document type definition in the input can pull in file://, network, or PHP-wrapper external entities that are expanded into the parsed document. Runtimes on libxml 2.13.0 or newer additionally set LIBXML_NO_XXE, which blocks the substitution. Upgrade to 2.7.6, 2.8.2, or 3.0.1, each of which drops LIBXML_NOENT from the default options.