XML External Entity (XXE) Injection Affecting org.springframework.restdocs:spring-restdocs-restassured package, versions [,3.0.6)[4.0.0-M1,]
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about XML External Entity (XXE) Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGSPRINGFRAMEWORKRESTDOCS-18322495
- published27 Jul 2026
- disclosed9 Jun 2026
- creditUnknown
Introduced: 9 Jun 2026
CVE-2026-40991 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.springframework.restdocs:spring-restdocs-restassured is a
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection.
due to improperly configured XML parsing in the PrettyPrintingContentModifier and XmlContentHandler classes, in PrettyPrintingContentModifier.java and payload/XmlContentHandler.java. When the spring-restdocs-webtestclient or spring-restdocs-restassured integration is used to document a remote API accessed over HTTP, XML content returned by the remote service is parsed with external entity resolution enabled. An attacker who compromises the documented API, or who tricks a user into documenting a malicious API, can embed external entity declarations in the XML, and these entities are resolved the next time the documentation-generating tests are executed. This exposes files readable by the test process to the attacker-controlled endpoint and enables limited denial of service through entity expansion.
Note:
This is only exploitable if the attacker first compromises or impersonates the API being documented, and if the victim user runs the documentation-generating tests.