Overview
About vulnerability
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK’s default DocumentBuilderFactory behavior instead of Spring’s hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks, including confidential file disclosure or server-side request forgery through external entities, depending on parser and platform behavior.
Preconditions include exposing XPath evaluation over data controlled or influenced by remote users (directly or through message paths), using the vulnerable source types without an additional hardening layer.