CVE-2021-27931

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 18.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-03 · updated 2026-06-17
Weakness: CWE-611

Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

Affected products

Lumis Experience Platform: before 10.0.0 — fixed in 10.0.0

How to fix

Upgrade to a fixed version: Lumis Experience Platform 10.0.0. Check the vendor advisory for mitigations.

References

https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt
https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt

Get alerted when CVE-2021-27931 or the next vulnerability affects your stack