What’s Vulnerable › Vulnerabilities

CVE-2024-39847: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-30 · updated 2026-06-17
• Weakness: CWE-611

Description

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Affected products

• 4D Server: 20-r3, 20-r4, 20-r6

References

• https://4d.com
• https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/
• http://seclists.org/fulldisclosure/2026/May/0

Get alerted when CVE-2024-39847 or the next vulnerability affects your stack