CVE-2026-73235: FreeCAD XXE Vulnerability

CVE-2026-73235 Overview

CVE-2026-73235 is an XML External Entity (XXE) vulnerability [CWE-611] in FreeCAD, an open-source multiplatform 3D parametric modeler. The flaw resides in the Xerces SAX2 XMLReader constructed by Base::XMLReader::XMLReader() in src/Base/Reader.cpp. The reader parses attacker-controlled Document.xml content from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file:// URI scheme or trigger server-side requests through the http:// URI scheme. Resolved content flows back through the characters() callback. The issue is fixed in FreeCAD version 1.1.2.

Critical Impact
A user opening a malicious .FCStd file can leak local file contents to an attacker or trigger outbound requests from the victim host.

Affected Products

FreeCAD versions prior to 1.1.2
FreeCAD .FCStd document parser (src/Base/Reader.cpp)
All platforms supported by FreeCAD (Windows, macOS, Linux)

Discovery Timeline

2026-08-11 - CVE-2026-73235 published to NVD
2026-08-12 - Last updated in NVD database
Fixed in - FreeCAD Release 1.1.2

Technical Details for CVE-2026-73235

Vulnerability Analysis

A .FCStd file is a ZIP archive containing Document.xml and associated resources. FreeCAD parses Document.xml using an Apache Xerces-C++ SAX2 XMLReader instantiated in Base::XMLReader::XMLReader(). The constructor did not disable external entity resolution or external DTD loading before parsing began.

An attacker crafts a Document.xml containing an external entity declaration referencing a file:// or http:// URI. When Document::restore() opens the file, the Xerces parser dereferences the entity, retrieves the referenced content, and passes it to the characters() SAX callback. The resolved data is then incorporated into the parsed document state, enabling exfiltration of local files or coercion of outbound HTTP requests from the victim workstation.

Root Cause

The root cause is missing hardening of the Xerces SAX2 reader configuration. Features such as http://apache.org/xml/features/disallow-doctype-decl and http://xml.org/sax/features/external-general-entities were not set to safe values, leaving Xerces default behavior — which permits external entity and DTD resolution — active during document parsing.

Attack Vector

Exploitation requires user interaction. The victim must open a crafted .FCStd document delivered through email, a shared project repository, or a model marketplace. Once opened, the malicious Document.xml triggers entity resolution during Document::restore(). Confidentiality impact is high because arbitrary readable files can be exfiltrated. Integrity impact is limited to the modeled document state populated from resolved entities.

cpp

// Patch excerpt: src/Base/Reader.cpp
 #include <string>
 #include <xercesc/sax2/XMLReaderFactory.hpp>
 #include <xercesc/sax2/Attributes.hpp>
+#include <xercesc/util/XMLUni.hpp>
 
 #include <locale>
// Source: https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73

The patch introduces xercesc/util/XMLUni.hpp so the reader can programmatically disable DOCTYPE declarations and external entity resolution before parsing untrusted Document.xml content. See FreeCAD commit 7d1b8f5 and FreeCAD commit d98eaf1 for the full changes.

Detection Methods for CVE-2026-73235

Indicators of Compromise

.FCStd archives whose internal Document.xml contains <!DOCTYPE declarations or <!ENTITY references with SYSTEM URIs
External entity references pointing to file:// paths, internal IP addresses, or unexpected http:// endpoints inside Document.xml
Unexpected outbound HTTP connections initiated by the FreeCAD process shortly after a document is opened

Detection Strategies

Inspect inbound .FCStd files by unzipping the archive and scanning Document.xml for DOCTYPE and ENTITY tokens before distribution.
Alert on FreeCAD child processes performing network egress to non-standard destinations, particularly to internal services or attacker-controlled domains.
Monitor file-read telemetry on hosts with FreeCAD installed for the process reading sensitive files (for example, /etc/passwd, SSH keys, browser credential stores) immediately after a document open event.

Monitoring Recommendations

Enable process and network telemetry on engineering workstations that handle third-party CAD files.
Log DNS resolutions performed by the FreeCAD process to detect SSRF-style callbacks embedded in documents.
Track FreeCAD version inventory to identify hosts still running versions prior to 1.1.2.

How to Mitigate CVE-2026-73235

Immediate Actions Required

Upgrade all FreeCAD installations to version 1.1.2 or later using the official 1.1.2 release.
Do not open .FCStd files received from untrusted sources until the upgrade is complete.
Review recently opened FreeCAD documents on unpatched hosts for signs of external entity references.

Patch Information

The fix ships in FreeCAD 1.1.2. Hardening changes are implemented in pull request #31271 and pull request #31280, with the reader modifications in commit 7d1b8f5 and commit d98eaf1. Full details are documented in GHSA-cp6c-87x9-xf49.

Workarounds

Block or quarantine .FCStd attachments at the email gateway until endpoints are patched.
Run FreeCAD on hosts with restrictive egress firewall rules that prevent outbound HTTP to arbitrary destinations.
Preprocess untrusted .FCStd files in a sandbox that strips DOCTYPE and ENTITY declarations from Document.xml before opening.

bash

# Inspect a suspect .FCStd archive for XXE payloads before opening
unzip -p suspect.FCStd Document.xml | grep -E '<!DOCTYPE|<!ENTITY|SYSTEM'