Critical severity9.8NVD Advisory· Published May 23, 2018· Updated Jun 17, 2026
CVE-2018-1309
CVE-2018-1309
Description
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.nifi:nifi-standard-processorsMaven | >= 0.1.0, < 1.6.0 | 1.6.0 |
Affected products
2Patches
Vulnerability mechanics
References
5- nifi.apache.org/security.htmlnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-42wx-65g4-5cxvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-1309ghsaADVISORY
- github.com/apache/nifi/commit/28067a29fd13cdf8e21b440fc65c6dd67872522fghsaWEB
- issues.apache.org/jira/browse/NIFI-4869ghsaWEB
News mentions
0No linked articles in our index yet.