Vulnerability record · CVE-2020-26259 · published 16 December 2020
CVE-2020-26259: XStream unmarshalling allows arbitrary local file deletion
Apache · Struts
XStream before 1.4.15 fails to block arbitrary file deletion on the local host when unmarshalling untrusted XML. A remote attacker who controls the processed input stream can delete known files on the host, limited only by the privileges of the executing process. The flaw does not affect Java 15 or higher, and deployments using XStream's Security Framework whitelist are not affected.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Automated analysis
high priorityThe flaw allows remote, unauthenticated file deletion with a very high EPSS score and public exploit material, though it is not in KEV and requires high attack complexity.
What it is
XStream before 1.4.15 fails to block arbitrary file deletion on the local host when unmarshalling untrusted XML. A remote attacker who controls the processed input stream can delete known files on the host, limited only by the privileges of the executing process. The flaw does not affect Java 15 or higher, and deployments using XStream's Security Framework whitelist are not affected.
Impact
An attacker gains the ability to delete arbitrary known files on the host, which can cause data loss, denial of service, or removal of security-relevant files. The CVSS vector rates integrity impact High with no confidentiality or availability impact recorded, though file deletion can indirectly degrade availability.
Attack surface
Reached remotely over the network by supplying a crafted XML stream to an application that unmarshals it with XStream; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). The attack requires conditions the vector rates as High complexity (AC:H).
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.824 (99.6th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade XStream to 1.4.15 or later, which fixes the default blacklist behavior.
- If upgrade is not possible, switch from the default blacklist to a Security Framework whitelist of allowed types.
- Apply the workaround described in the vendor advisory for users of 1.4.14 and below who must keep the default blacklist.
- Apply vendor patches for bundled copies, including Apache Struts, Debian and Fedora packages.
- Do not unmarshal untrusted XML with XStream; treat all incoming serialized data as hostile.
Detection
- Monitor application logs and file system audit trails for unexpected deletion of known files by Java processes using XStream.
- Alert on XStream unmarshalling of XML from untrusted or external sources, especially where the default blacklist is in use.
- Inventory applications and dependencies for XStream versions below 1.4.15, including copies bundled in Struts and Linux distribution packages.
- Watch for XML payloads containing XStream class references or converter elements associated with file operations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-26259 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-26259), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
