CVE-2018-11788

CRITICAL

Apache Karaf < 4.1.7 and 4.2.0-4.2.2 - XML External Entity Injection via Features XML Deployer

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-11788. PoCs published by brianwrf.

AI-analyzed exploit summary This repository contains a detailed writeup and proof-of-concept for CVE-2018-11788, an XXE vulnerability in Apache Karaf's features deployer. The vulnerability allows external entity injection due to improper XML parsing.

Description

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

Exploits (1)

nomisec WRITEUP 38 stars
by brianwrf · poc
https://github.com/brianwrf/CVE-2018-11788

This repository contains a detailed writeup and proof-of-concept for CVE-2018-11788, an XXE vulnerability in Apache Karaf's features deployer. The vulnerability allows external entity injection due to improper XML parsing.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Apache Karaf <= 4.2.1, Apache Karaf <= 4.1.6
No auth needed
Prerequisites: Access to the deploy folder of Apache Karaf
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
http://karaf.apache.org/security/cve-2018-11788.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/106479

Scores

CVSS v3 9.8
EPSS 0.2475
EPSS Percentile 96.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (3)
apache/karaf 4.2.0 milestone1 (2 CPE variants)
apache/karaf < 4.1.7
org.apache.karaf.specs/org.apache.karaf.specs.java.xml 4.2.0 - 4.2.2Maven
Published Jan 07, 2019
Tracked Since Feb 18, 2026