EIP-2026-109240

This advisory details an XXE (XML External Entity) injection vulnerability in Magento eCommerce Platform, allowing arbitrary local file disclosure via maliciously crafted XML-RPC requests. The issue stems from insecure use of the SimpleXMLElement class in the Zend framework.