CVE-2026-3511: Slovensko.Digital Autogram SSRF Vulnerability

CVE-2026-3511 Overview

CVE-2026-3511 is an XML External Entity (XXE) vulnerability in XMLUtils.java within Slovensko.Digital Autogram, a Slovak electronic signature application. The flaw allows a remote unauthenticated attacker to trigger Server-Side Request Forgery (SSRF) and read local files from the system running the vulnerable application. Exploitation requires a victim to visit a malicious website that sends a crafted XML document to the /sign endpoint of the local HTTP server run by Autogram. The vulnerability is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Remote unauthenticated attackers can read arbitrary local files and force the host to issue SSRF requests by tricking a user into visiting a malicious page.

Affected Products

Slovensko.Digital Autogram (electronic signature application)
Autogram versions prior to v2.7.2
The local HTTP server component exposing the /sign endpoint

Discovery Timeline

2026-03-19 - CVE-2026-3511 published to NVD
2026-03-19 - Last updated in NVD database
Autogram v2.7.2 - Fixed release published on GitHub

Technical Details for CVE-2026-3511

Vulnerability Analysis

The vulnerability resides in XMLUtils.java, where the XML parser processes input without disabling external entity resolution. When Autogram runs, it starts a local HTTP server that listens for signing requests on the /sign endpoint. A remote website can issue a cross-origin request containing a crafted XML payload to this local endpoint. The XML parser then resolves external entity references, fetching content from attacker-specified URIs or local file paths.

The scope change reflected in the impact rating indicates the attack crosses a trust boundary: code executing in the victim's browser context coerces the desktop application to perform privileged file and network operations. Confidentiality impact is high because the application typically runs with user-level access to sensitive documents and signing material.

Root Cause

The parser configuration in XMLUtils.java does not disable DOCTYPE declarations, external general entities, or external parameter entities. Java XML parsers process these constructs by default unless features such as http://apache.org/xml/features/disallow-doctype-decl are explicitly set. The local /sign endpoint accepts XML bodies from any origin without validating the document structure or rejecting entity declarations.

Attack Vector

An attacker hosts a webpage that issues an HTTP request to http://localhost:<port>/sign containing an XML document with a malicious external entity. The entity references either a local file (for example, file:///etc/passwd or a user document) or an attacker-controlled URL for SSRF. When Autogram parses the body, it dereferences the entity and either returns file contents in error output, signature responses, or forwards the request to internal network resources. No authentication, no user credentials, and no application interaction beyond browsing the malicious page are required.

No verified proof-of-concept code is published; technical specifics are documented in the Binary House blog post and the Autogram v2.7.2 release notes.

Detection Methods for CVE-2026-3511

Indicators of Compromise

Inbound HTTP POST requests to http://localhost:<port>/sign originating from browser tabs the user did not intentionally use for signing.
XML request bodies containing <!DOCTYPE> declarations or <!ENTITY> references with SYSTEM identifiers pointing to file:// URIs or external hosts.
Outbound network connections from the Autogram process to URLs that do not correspond to legitimate signing infrastructure.

Detection Strategies

Inspect local HTTP server access logs for /sign requests with Content-Type: application/xml or text/xml containing DOCTYPE strings.
Apply endpoint detection rules that flag the Autogram process when it issues file reads outside its working directory immediately after receiving network input.
Monitor host process telemetry for unexpected child processes or file access patterns correlated with browser-originated localhost traffic.

Monitoring Recommendations

Forward Autogram process and network telemetry into a centralized SIEM and alert on outbound connections initiated by the Autogram binary.
Track installed Autogram versions across the fleet and alert when versions earlier than v2.7.2 are observed.
Review browser proxy or DNS logs for repeated requests to attacker-controlled hosts paired with localhost POST activity.

How to Mitigate CVE-2026-3511

Immediate Actions Required

Upgrade Slovensko.Digital Autogram to v2.7.2 or later on every affected workstation.
Until patching is complete, stop the Autogram local HTTP server when signing is not actively in use.
Restrict outbound network access from the Autogram process at the host firewall to known signing service endpoints only.

Patch Information

The maintainers fixed the issue in Autogram v2.7.2. The patched build hardens XMLUtils.java by disabling DOCTYPE processing and external entity resolution in the XML parser configuration. Download details and release notes are available at the Autogram v2.7.2 GitHub release.

Workarounds

Block browser access to the Autogram local server port using host-based firewall rules when the application is not actively signing documents.
Configure browsers or endpoint controls to prevent cross-origin requests to localhost for users who cannot patch immediately.
Educate users to close the Autogram application when finished signing so the local HTTP listener is not exposed to drive-by attacks.

bash

# Configuration example: block external access to Autogram's local port (Linux iptables)
# Replace <AUTOGRAM_PORT> with the actual port used by Autogram
iptables -A INPUT -p tcp --dport <AUTOGRAM_PORT> ! -s 127.0.0.1 -j DROP