CVE-2026-32251 Tolgee has an XXE Injection in Translation Import

What is CVE-2026-32251?

CVE-2026-32251 is a critical vulnerability in tolgee-platform, published on 12 Mar 2026.

Official description

Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files from the server and make server-side requests to internal services. This vulnerability is fixed in 3.166.3.

Weakness: CWE-611

Which versions are affected by CVE-2026-32251?

It affects 1 product.

Products include Tolgee Tolgee.

How do I fix CVE-2026-32251?

No fix has been published for CVE-2026-32251 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-32251 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32251 exists.

Other vulnerabilities in tolgee-platform

• CVE-2024-52297 Tolgee's configuration all configuration properties leaked in public configuration DTO Critical 9.8
• CVE-2023-38510 Tolgee Lacks Permission Check for API Key for some endpoints High 8.1
• CVE-2024-32470 Tolgee' API keys created by server admin users bypass the permission check Medium 6.5
• CVE-2023-41316 HTML Injection with email in Tolgee Medium 5.5
• CVE-2024-32466 Tolgee's API key scopes not checked when querying translation data Low 2.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rcvv-64pq-vxfx.