Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-09 | 1 | Disclosure1 |
| 2026-08-03 | 1 | Patch1 |
医療情報の規格FHIRのJava実装、HAPI FHIRにXXEの脆弱性です。XSLT変換で外部参照の制限を設定しておらず、変換にかけるXMLを攻撃者が用意できるとファイル読み出しやSSRFにつながります。CVSS 9.1、修正は6.9.10。依存は推移的に入りやすいのでdep… https://cve.autoarticles.net/cve/CVE-2026-55471
Post summary
The post announces a high‑severity XXE vulnerability in HAPI FHIR, lists a remedial version (6.9.10), and provides technical details but no PoC or exploitation evidence.
CVE-2026-55471 HAPI FHIR XXE in HAPI FHIR XML transformation could expose local files or enable blind SSRF in healthcare interoperability systems Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-07-08/TIER_2_CVE-2026-55471.md #CyberSecurity #HealthcareCybersecurity #VulnerabilityManagement
Post summary
The text announces the discovery of an XXE/SSRF vulnerability in HAPI FHIR, providing technical details but no evidence of exploitation or mitigations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hapifhir | hl7_fhir_core | - | - | - |