CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-54640

The OpenRemote IoT platform is vulnerable to an XML External Entity (XXE) injection in the KNXProtocol.startAssetImport() method. This occurs because the KNXProtocol handler, located in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java, processes user-uploaded ETS project ZIP...