Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-16626

JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Jaspersoft

Description

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jaspersoft JasperReports Server

Default version status: unaffected

  • 9.0.0 to < HF-9affected
  • 10.0.0 to < HF-10affected

References