XML External Entity (XXE)

hapi-fhir-utilities is vulnerable to XML external entities XXE. An attacker is able to provide malicious XML input containing a reference to an external entity and retrieve system files. The vulnerability exists as the library does not disable external DTDs and doctype declarations by default...