Peergos WebDav Servlet XML External Entity Injection Vulnerability

A vulnerability allowing XML External Entity (XXE) injection has been identified in the WebDav servlet of Peergos, affecting versions through 1.1.0. The issue arises from improper handling of XML external entity references in the 'getDocumentBuilder()' method, which could be exploited to manipulate XML data processing.

Impact

Exploitation of this vulnerability could lead to XXE injection, allowing attackers to interfere with the application's XML processing. This could result in the application disclosing internal files or potentially executing arbitrary code, depending on the application's environment and how it handles the extracted data.

Remediation

The vulnerability has been addressed in the official Peergos repository. Users should update to the latest version.