CVE-2026-2253

Published: May 27, 2026Modified: Jul 24, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security.vulnerabilities@hitachivantara.com (Secondary)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.

Affected (4)

Products: Hitachi: Vantara Pentaho Data Integration And Analytics

Hitachi

1 product

Vantara Pentaho Data Integration And Analytics

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho Data Integration And Analytics	Before 10.2.0.7
Hitachi Vantara Pentaho Data Integration And Analytics	After 10.2.0.8 to 11.0.0.0
Hitachi Vantara Pentaho Data Integration And Analytics	Version 8.3
Hitachi Vantara Pentaho Data Integration And Analytics	Version 9.3

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

https://support.pentaho.com/hc/en-us/articles/45677548193933--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2026-2253

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

Timeline

No history available yet.