CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
Attackers can read arbitrary files and execute code by tricking examiners into previewing a malicious UFDR archive containing crafted XML and XSLT.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82525?
CVE-2026-82525 is a medium-severity vulnerability in Exterro FTK Imager, published on 3 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.
Which versions are affected by CVE-2026-82525?
How do I fix CVE-2026-82525?
No fix has been published for CVE-2026-82525 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82525 being exploited?
There is no known exploitation of CVE-2026-82525 in the wild and no public exploit code.
Sources
Also known as GHSA-pjc3-pxrj-h263.