CVE-2026-69101
Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.
| CWE | CWE-611 |
| Vendor | datavane |
| Product | tis |
| Published | Aug 14, 2026 |
Get instant alerts for datavane tis
Be the first to know when new high vulnerabilities affecting datavane tis are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N