What’s Vulnerable › Vulnerabilities

CVE-2016-9487: EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-611

Description

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.

Affected products

• EpubCheck: 4.0.1

References

• https://www.kb.cert.org/vuls/id/779243
• https://www.securityfocus.com/bid/94864/
• https://www.kb.cert.org/vuls/id/779243
• https://www.securityfocus.com/bid/94864/

Get alerted when CVE-2016-9487 or the next vulnerability affects your stack