An XML external entity injection vulnerability in YaCy Search Server allows unauthenticated attackers to exfiltrate local files via malicious document uploads.

The application utilizes XML parsers that do not explicitly restrict the resolution of external entities. An unauthenticated attacker can supply crafted SVG, FreeMind, or OpenSearch files containing malicious DOCTYPE declarations to force the server to read and index arbitrary local files.

The ability to read arbitrary files from the server filesystem poses a significant risk to data confidentiality. Attackers could potentially access sensitive configuration files, environment variables, or internal system data, which may facilitate further compromise or lateral movement. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that could lead to full unauthorized disclosure of information stored on the host system.

Immediate Action: Update YaCy Search Server to the version containing the fix, or apply the upstream patch provided in commit 3c3a307e8b7a0ebbc4d1e6b10898b52e15c0cd44.

Proactive Monitoring: Monitor server logs for unusual crawl requests or documents containing XML DOCTYPE definitions that reference suspicious system paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block incoming XML payloads containing DOCTYPE or ENTITY declarations.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a high risk due to the potential for unauthenticated local file disclosure. Organizations running YaCy Search Server must prioritize updating their instances to the patched version or applying the identified source code fix to prevent unauthorized access to sensitive system information.