CVE-2020-11991: Apache Cocoon StreamGenerator XML external entity file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) with no authentication or interaction required, public exploit references and a very high EPSS score, though no confirmed in-the-wild KEV listing.

What it is

Apache Cocoon's StreamGenerator parses user-supplied XML without disabling external system entities, allowing XML External Entity (XXE) injection. An attacker can craft XML that references local files, causing the server to read and return their contents. This exposes sensitive files such as configuration or credential files on the host.

Impact

An attacker gains read access to arbitrary files on the server filesystem, potentially leaking credentials, configuration and other sensitive data. There is no write or code execution impact per the CVSS vector.

Attack surface

Reachable over the network via the StreamGenerator component that accepts user-provided XML; the CVSS vector shows no privileges or user interaction required. Any endpoint feeding attacker-controlled XML into StreamGenerator is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.72456, 99.4th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Apache Cocoon to a version that fixes the StreamGenerator XXE issue; check the vendor advisory for the fixed release.
• If patching is not immediate, disable or restrict the StreamGenerator component and reject untrusted XML input.
• Configure the XML parser to disable external entity and DTD processing (e.g., disallow-doctype-decl, external-general-entities and external-parameter-entities off).
• Run the service with least privilege and restrict filesystem read access so leaked files are limited.
• Place the service behind a WAF or input filter that blocks DOCTYPE and external entity declarations in XML payloads.

Detection

• Search application and access logs for XML requests containing DOCTYPE, ENTITY or SYSTEM keywords.
• Monitor for outbound or local file reads triggered by XML parsing, especially requests to unusual file paths.
• Alert on StreamGenerator endpoint requests with XML bodies from untrusted sources.
• Review server file access logs for reads of sensitive files (e.g., /etc/passwd, config files) correlated with web requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.