CVE-2026-73235

Name of the Vulnerable Software and Affected Versions FreeCAD versions prior to 1.1.2

Description The software fails to disable default external entity resolution or external DTD loading when the Base::XMLReader::XMLReader() function in src/Base/Reader.cpp parses a Document.xml file within a crafted .FCStd archive. When the Document::restore() function opens the document, an attacker can use external entities to read local files via the file URI scheme or trigger server-side requests via the http URI scheme, with the resolved content flowing through the characters() callback.

Recommendations Update to version 1.1.2.