CVE-2020-11991

Apache Cocoon 2.1.12 is vulnerable to XML injection via the StreamGenerator when parsing user-supplied XML containing external entities. This can allow reading arbitrary files on the server. The connected template explicitly notes the issue and recommends upgrading to Apache Cocoon 2.1.13 or late...