CVE-2026-36765 - An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload

Back Back to CVE browser

HIGH

An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload

Published Apr 30, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.60%

Description

An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

Link	Providers	Tags
https://github.com/chillzhuang/SpringBlade
https://github.com/chillzhuang/SpringBlade/issues/37		exploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 30, 2026

Updated May 4, 2026

Reserved Apr 6, 2026

Link CVE-2026-36765

CISA Vulnrichment

Updated May 4, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-36765

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-36765