CVE-2026-54640

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54640

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54640.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54640

Aliases

GHSA-7v6w-c3f4-9wpq

Published

2026-10-13T16:02:21Z

Modified

2026-10-28T11:14:38Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

Details

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-611"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54640.json"
}

References

Affected packages

Git / github.com/openremote/core

Affected ranges

Type

GIT

Repo

https://github.com/openremote/core

Events

Introduced

Fixed

c312ee8b2a7ccd0bda6a42b6ba26a5c7ab44a6d0

Fixed

c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.24.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "1.24.2",
            "range": [
                {
                    "fixed": "c312ee8b2a7ccd0bda6a42b6ba26a5c7ab44a6d0"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.10.0

1.11.0

1.11.1

1.11.2

1.11.3

1.12.0

1.12.1

1.12.2

1.12.3

1.13.0

1.13.1

1.14.0

1.15.0

1.15.1

1.15.2

1.16.0

1.16.1

1.17.0

1.17.1

1.17.2

1.17.3

1.18.0

1.19.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.22.1

1.23.0

1.23.1

1.24.0

1.24.1

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0

1.5.0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.8.0

1.8.1

1.9.0

Other

archive/console_loader

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54640.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "312334892452971045911984284225597696259",
                "1690376385291886234243148543071357152",
                "260212604356217851046736739661446844682",
                "77549858029604095787205807040583109784",
                "120822428519345376930921143365625423634",
                "219860525082732431748606924267028147016",
                "68382656059076878561563180082666942983",
                "151030848970576730943344613500898341212",
                "221585681575807477745084228064120184101",
                "89008285230086170832480679584052327446",
                "75495067416477289280163318967139422528",
                "116827172769470807067503880405469588220",
                "14170188763129360521594206008472147021",
                "104389786285489719548055752292187114506",
                "215774677478288090370505544833605149066",
                "186583477090407812148731222175319905956",
                "279091484833236524441504952314602508665",
                "186518394385485301723804347174819028471",
                "241050085937121437412927351614909918980",
                "297636248896005616283561745864218800541",
                "3672427629926216989436020566547169156",
                "24630903273808012460352376552745479682",
                "31308610094148713175936639150637673235",
                "100840648460881970338548415885342066560",
                "45172280732740135753624814232681922503",
                "325732229121932972911355092467892825842",
                "157301001757385158838630566108937335783",
                "29101119990225363511400205003991328275",
                "110583204761401943486903859762214588379"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54640-4edee17d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9",
        "target": {
            "file": "agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "259308382391295651769518669690347514916",
            "length": 2400
        },
        "id": "CVE-2026-54640-f2ea8e2d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9",
        "target": {
            "file": "agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java",
            "function": "startAssetImport"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:14:38Z"