CVE-2026-36765 Details

A vulnerability allowing XML external entity (XXE) injection has been identified in the SpringBlade framework, specifically in version 4.8.0 of the blade-report module, which integrates UReport2. This vulnerability allows authenticated attackers to execute arbitrary code by injecting a crafted payload through the 'saveReportFile' endpoint, which is then parsed by the 'loadReport' endpoint. The underlying XML parser does not disable external entity resolution or DOCTYPE declarations, enabling the injection of malicious entities that can read sensitive files or disrupt server operations.

To address this vulnerability, it is recommended to disable the report designer functionality in production environments, especially if it is not needed. At the code level, the XML parser should be configured to disallow external entities and DOCTYPE declarations before parsing any report XML. Additionally, UReport2 should be upgraded or replaced with an actively maintained reporting engine, as UReport2 is known to contain multiple vulnerabilities.