CVE-2026-32251

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32251
Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files from the server and make server-side requests to internal services. This vulnerability is fixed in 3.166.3.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/tolgee/tolgee-platform/commit/7c71d5a849c9984a8c5c55b121992417442a47a5 Patch
https://github.com/tolgee/tolgee-platform/releases/tag/v3.166.3 Release Notes
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx Exploit Vendor Advisory
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*
History

20 Mar 2026, 15:57

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Tolgee
Tolgee tolgee
References () https://github.com/tolgee/tolgee-platform/commit/7c71d5a849c9984a8c5c55b121992417442a47a5 - () https://github.com/tolgee/tolgee-platform/commit/7c71d5a849c9984a8c5c55b121992417442a47a5 - Patch
References () https://github.com/tolgee/tolgee-platform/releases/tag/v3.166.3 - () https://github.com/tolgee/tolgee-platform/releases/tag/v3.166.3 - Release Notes
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx - Exploit, Vendor Advisory
CPE cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*

13 Mar 2026, 19:54

Type Values Removed Values Added
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-rcvv-64pq-vxfx -
Summary
  • (es) Tolgee es una plataforma de localización de código abierto. Antes de la versión 3.166.3, los analizadores XML utilizados para importar recursos XML de Android (.xml) y archivos .resx no deshabilitaban el procesamiento de entidades externas. Un usuario autenticado que puede importar archivos de traducción a un proyecto puede explotar esto para leer archivos arbitrarios del servidor y realizar solicitudes del lado del servidor a servicios internos. Esta vulnerabilidad está corregida en la versión 3.166.3.

12 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 20:16

Updated : 2026-03-20 15:57

NVD link : CVE-2026-32251

Mitre link : CVE-2026-32251

CVE.ORG link : CVE-2026-32251

JSON object : View

Products Affected

tolgee

  • tolgee
CWE
CWE-611

Improper Restriction of XML External Entity Reference