Insufficient restriction of XML external entities that could allow attackers to read arbitrary files

Information

• Advisory ID: DSA-2026-022

• CVSS Base Score: 8.8

• CVSS String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Severity: High

• CWE classification: CWE-611

Summary

In Dataiku before 14.7.7, and in Dataiku between 15.0.0 inclusive and 15.2.2 exclusive, insufficient restriction of XML external entities could allow authenticated attackers to read arbitrary files.

Affected Products

• Dataiku before 14.7.7

• Dataiku between 15.0.0 inclusive and 15.2.2 exclusive

Fix

Dataiku 14.7.7 and 15.2.2 have been made available to customers to remediate this issue.