CVE-2025-47293 PowSyBl Core XML Reader allows XXE and SSRF
Attackers can exploit XML parsing flaws to read sensitive files and perform server-side requests, impacting multi-tenant power system applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47293?
CVE-2025-47293 is a low-severity vulnerability in powsybl-core, published on 19 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
Which versions are affected by CVE-2025-47293?
2 open source packages ship an affected version, including com.powsybl:powsybl-commons.
| Package | Affected | Fixed in |
|---|---|---|
com.powsybl:powsybl-commons Maven | All versions | 6.7.2 |
com.powsybl:powsybl-commons Maven | All versions | 6.7.2 |
How do I fix CVE-2025-47293?
Upgrade com.powsybl:powsybl-commons to 6.7.2 or later.
Is CVE-2025-47293 being exploited?
There is no known exploitation of CVE-2025-47293 in the wild and no public exploit code.
Sources
Also known as GHSA-qpj9-qcwx-8jv2.