CVE-2025-31497

Summary

CVE-2025-31497 is a critical vulnerability affecting TEIGarage's Document Conversion Service. The service, which processes XML files during conversion, fails to disable external entity processing, exposing the server to XML External Entity (XXE) Injection attacks. An attacker can exploit this vulnerability to read arbitrary files from the server's filesystem, potentially gaining access to sensitive information such as configuration files, credentials, or other confidential data. In addition, the vulnerability could be used for Server-Side Request Forgery (SSRF) attacks, enabling an attacker to make the server connect to internal services. The issue has been patched in version 1.2.4, and a temporary workaround is to disable external entity processing in the XML parser.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.