CVE-2026-54640

HIGH 7.6

OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

CWE	CWE-611
Vendor	openremote
Product	openremote
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for openremote openremote

Be the first to know when new high vulnerabilities affecting openremote openremote are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Affected Versions

openremote / openremote

< 1.24.2

io.openremote / openremote-manager

< 1.24.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openremote/core/security/advisories/GHSA-7v6w-c3f4-9wpq github.com: https://github.com/openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9 github.com: https://github.com/openremote/core/releases/tag/1.24.2