A critical XML External Entity (XXE) vulnerability in Eclipse RDF4J allows unauthenticated attackers to access sensitive local files or perform server-side request forgery.

The software contains an XXE vulnerability (CWE-611) because it does not properly disable external entity processing when parsing untrusted XML data or query results.

The CVSS score of 8.7 reflects the high risk of this vulnerability. An attacker can use this flaw to read arbitrary files from the server's filesystem, perform port scanning, or execute server-side request forgery (SSRF) attacks, potentially exposing internal network resources and sensitive data.

Immediate Action: Update Eclipse RDF4J to version 5.3.2 or later to ensure proper XML parser configuration.

Proactive Monitoring: Monitor network traffic for unusual outbound requests originating from the server, which may indicate attempted SSRF activity.

Compensating Controls: Configure the underlying XML parsers to explicitly disable DTDs and external entity processing if an immediate upgrade is not feasible.

Public Exploit Available: Unknown

Given the potential for unauthorized data exfiltration, organizations should prioritize upgrading to version 5.3.2 immediately. Ensure that all applications utilizing the RDF4J framework are updated to prevent remote exploitation.