Threat Investigation
Request a demo

CVE-2026-3511

High

Description

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

SeverityHigh
CVSS8.6
Exploit probability—
ProductAutogram
PublishedMar 19, 2026
First seenMar 19, 2026
Weakness typeCWE-611XML external entity (XXE)

How to fix

Update
  • Slovensko.Digital Autogram2.7.2 or later

Affected products

ProductAffected versionsFixed in
Slovensko.Digital Autogramv < 2.7.22.7.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.