CVE-2026-82880: YaCy Search Server XXE Vulnerability

CVE-2026-82880 Overview

CVE-2026-82880 is an XML External Entity (XXE) injection vulnerability in YaCy Search Server through version 1.941. The flaw resides in the SVG, FreeMind, and OpenSearch parsers, which fail to disable external entity resolution during XML processing. Attackers can publish malicious documents containing DOCTYPE declarations with SYSTEM entities referencing local files. When the YaCy crawler fetches and parses these documents, it resolves the external entities and incorporates the contents into its searchable index. This gives remote, unauthenticated attackers a way to exfiltrate local files from any YaCy node that crawls their content. The vulnerability is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary local file contents from YaCy nodes by publishing crafted SVG, FreeMind, or OpenSearch documents that the crawler ingests.

Affected Products

YaCy Search Server versions through 1.941
Components: svgParser.java, mmParser.java (FreeMind), and opensearchdescriptionReader.java
Any YaCy deployment that crawls untrusted external content

Discovery Timeline

2026-08-31 - CVE-2026-82880 published to the National Vulnerability Database
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82880

Vulnerability Analysis

YaCy is a peer-to-peer distributed search engine that crawls and indexes web content. Three of its XML-based parsers instantiate a SAXParser through SAXParserFactory.newInstance().newSAXParser() without disabling DOCTYPE processing or external entity resolution. Because the default JAXP configuration permits external entities, any XML document containing a SYSTEM entity is fully resolved when parsed.

During crawling, YaCy fetches SVG images, FreeMind mind maps (application/x-freemind), and OpenSearch description documents advertised by remote sites. Malicious content in any of these formats causes the parser to read files from the local file system of the YaCy node. The resolved entity contents are then written into the search index, where they can be retrieved through normal search queries against the attacker-controlled document.

Root Cause

The root cause is missing hardening on the SAX parser factory in three locations: svgParser.java line 72, mmParser.java line 66, and opensearchdescriptionReader.java line 119. None of these call sites set disallow-doctype-decl, external-general-entities, or external-parameter-entities, so the parser accepts and resolves external entities from crawled documents.

Attack Vector

An attacker hosts a malicious SVG, FreeMind, or OpenSearch document on a publicly reachable site. When a YaCy peer crawls the URL, the parser resolves DOCTYPE entities such as <!ENTITY xxe SYSTEM "file:///etc/passwd"> and inserts the file contents into the index. The attacker then queries the YaCy node for their own document and retrieves the leaked data. No authentication or user interaction on the YaCy side is required.

java

// Patched SAXParser initialization (svgParser.java)
private static final SAXParser PARSER;
static {
    try {
        SAXParserFactory spf = SAXParserFactory.newInstance();
        spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
        spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        PARSER = spf.newSAXParser();
    } catch (SAXException | ParserConfigurationException e) {
        throw new ExceptionInInitializerError(e);
    }
}
// Source: https://github.com/yacy/yacy_search_server/commit/3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44

Detection Methods for CVE-2026-82880

Indicators of Compromise

Crawler logs showing fetches of SVG, .mm (FreeMind), or OpenSearch XML documents from unfamiliar external hosts
Search index entries that contain fragments of local system files such as /etc/passwd, /etc/hosts, or Windows configuration paths
Unusual outbound requests from the YaCy JVM to attacker-controlled hosts during document parsing, indicative of external entity resolution

Detection Strategies

Scan the YaCy search index for tokens characteristic of leaked files, including root:x:0:0, [boot loader], or embedded private key headers
Review parser code paths against the fixed commit 3c3a307 to confirm DOCTYPE and external entity features are disabled
Monitor JVM process behavior for file reads to sensitive paths triggered by XML parsing threads

Monitoring Recommendations

Enable egress logging on hosts running YaCy and alert on connections initiated by the JVM to arbitrary external URIs during crawl operations
Track file access events on paths that legitimate YaCy operations should never touch, such as /etc/shadow or SSH key directories
Correlate crawl activity with search-index write events to identify documents that added unusually large or file-like content payloads

How to Mitigate CVE-2026-82880

Immediate Actions Required

Upgrade YaCy Search Server to a build that includes commit 3c3a307, which hardens the SVG, FreeMind, and OpenSearch parsers
Audit existing search indexes for leaked file content and purge any entries that reference sensitive host data
Restrict outbound network egress from YaCy nodes to limit exfiltration paths if patching cannot be immediate

Patch Information

The upstream fix in commit 3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44 replaces the vulnerable SAXParserFactory initialization with a hardened static parser that sets disallow-doctype-decl to true and disables both general and parameter external entities. The change is applied consistently across svgParser.java, mmParser.java, and opensearchdescriptionReader.java. See the YaCy Issue #818 and the VulnCheck Advisory for additional context.

Workarounds

Run YaCy under a dedicated low-privilege user account with a restrictive file system view to reduce what an XXE read can reach
Deploy YaCy inside a container or sandbox with read-only mounts, denying access to configuration and credential files
Temporarily disable crawling of SVG, FreeMind, and OpenSearch content types until the patched build is deployed

bash

# Verify SAX parser hardening in a running YaCy build
grep -R "disallow-doctype-decl" source/net/yacy/document/parser/
# Expected: matches in svgParser.java, mmParser.java, and opensearchdescriptionReader.java