Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files from the server and make server-side requests to internal services. This vulnerability is fixed in 3.166.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-12 | 3 | Disclosure2Patch1 |
| 2026-04-08 | 2 | Disclosure2 |
Reading /etc/ passwd via translation file upload in Tolgee's cloud platform (CVE-2026-32251, CVSS 9.3) https://simonkoeck.com/writeups/tolgee-xxe-translation-import
Post summary
The post discloses an XXE vulnerability (CVE‑2026‑32251) that allows reading /etc/passwd in Tolgee’s cloud platform, includes a high CVSS score, and links to a writeup containing a PoC, but no evidence of active exploitation or patches.
Tolgee XML translation import vulnerable to XXE allowing arbitrary file read via CVE-2026-32251 — attackers can upload crafted translation files to read /etc/passwd, environment secrets, or cloud metadata credentials, impacting multi-tenant deployments until parser security was fixed. https://simonkoeck.com/writeups/tolgee-xxe-translation-import
Post summary
The post announces a CVE-2026-32251 exploit in Tolgee's XML translation import that permits arbitrary file reads via XXE; a proof of concept is linked to a writeup.
CVE-2026-32251 Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable extern… https://www.cve.org/CVERecord?id=CVE-2026-32251
Post summary
The post highlights that Tolgee’s XML parsing before version 3.166.3 fails to disable external entities, implying a vulnerability that is likely addressed in 3.166.3.
CVE-2026-32251 XML External Entity (XXE) Vulnerability in Tolgee Localization Platform ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32251 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text announces the discovery of an XML External Entity (XXE) vulnerability (CVE‑2026‑32251) in the Tolgee Localization Platform and provides links to detailed notes, but it contains no PoC, exploit, or patch information.
🚨 CVE-2026-32251: Tolgee has an XXE Injection in T... XXE in translation imports = instant server filesystem access and SSRF against internal services - classic XML parser f... https://zerodaysignal.com/vulnerability/CVE-2026-32251 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces the discovery of CVE-2026-32251, a server-side XSS vulnerability in Tolgee that allows filesystem access and SSRF, with a link presumably containing a PoC but no active exploitation or patch info.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tolgee | tolgee | - | - | - |