GCVE-1988-2026-0186

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Blind XXE in",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hanno Böck"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During tests of electronic invoicing tools, I discovered multiple XXE\nand Blind XXE vulnerabilities in online tools parsing electronic\ninvoices in XML formats.\n\nWhile most of the affected tools have fixed these vulnerabilities, two\nonline tools remain vulnerable to Blind XXE attacks, allowing\nexfiltration of files. Disclosure to the affected operators happened\nmore than 90 days ago.\n\nVulnerable tools:\n\nhttps://validator.invoice-portal.de/\nhttps://xrechnung.rib.de/ (only the visualization tool)\n\nIn both cases, uploading an invoice with a blind XXE payload leads to\nHTTP requests to the attacker's server and exfiltrates file content.\nProof of concepts, e.g., to exfiltrate /etc/hostname\n(ciibxxehostname.xml), can be found here:\n  https://github.com/hannob/invoicesec\n\n\nTimeline validator.invoice-portal.de:\n2025-11-17 Informed support contact about Blind XXE vulnerability, no\nreply\n2026-02-16 Still vulnerable, public disclosure\n\nTimeline xrechnung.rib.de:\n2025-10-29 Reported \"standard\" XXE via contact form, no reply\n2025-11-18 Re-test, incomplete fix: \"Standard\" XXE fixed, Blind XXE\nstill possible\n2025-11-18 Re-reported incomplete fix, no reply\n2026-02-16 Still vulnerable, public disclosure\n\nThis was part of a larger research effort about the security of EU\nelectronic invoices:\n  https://invoice.secvuln.info/\n\n-- \nHanno Böck - Independent security researcher\nhttps://itsec.hboeck.de/\nhttps://badkeys.info/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/20"
        },
        {
          "url": "https://badkeys.info/"
        },
        {
          "url": "https://github.com/hannob/invoicesec"
        },
        {
          "url": "https://invoice.secvuln.info/"
        },
        {
          "url": "https://itsec.hboeck.de/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://validator.invoice-portal.de/"
        },
        {
          "url": "https://xrechnung.rib.de/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Blind XXE in Electronic Invoice online tools (validator.invoice-portal.de, xrechnung.rib.de)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0186",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/20",
            "automated": true,
            "contentSha256": "af11b28805d327d5357150ff1f7b2f84ef33264082dbaf31b009dfea5e6473f3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T09:48:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0186"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}