CVE-2026-55471 | HAPI FHIR is a complete implementation of the HL7 FHIR stand… | CVSS 8.7 HIGH

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

Metadata

CVE ID: CVE-2026-55471
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 22:10 UTC
Published: 2026-07-08 21:28 UTC
Last updated: 2026-07-08 21:28 UTC
Primary CWE: CWE-611
CWE-611: Improper Restriction of XML External Entity Referen…
Vendor / Product: hapifhir / org.hl7.fhir.core
Sources: cve.org · NVD

Severity & Metrics

8.7 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
hapifhir	org.hl7.fhir.core	—	< 6.9.10

Weakness (CWE)

CWE	Source	Description
CWE-611	cna	CWE-611: Improper Restriction of XML External Entity Reference

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References (3)

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf
https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298 https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10 https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10