CVE-2017-5661

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

• CWE-611

• http://www.debian.org/security/2017/dsa-3864
• http://www.securityfocus.com/bid/97947
• https://www.tenable.com/security/tns-2021-14
• https://xmlgraphics.apache.org/security.htmlPatch, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3864
• http://www.securityfocus.com/bid/97947
• https://www.tenable.com/security/tns-2021-14
• https://xmlgraphics.apache.org/security.htmlPatch, Vendor Advisory

Published

Apr 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5655In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive da…
• CVE-2017-5656Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawe…
• CVE-2017-5657Several REST service endpoints of Apache Archiva are not pro…
• CVE-2017-5658The statistics generator in Apache Pony Mail 0.7 to 0.9 was …
• CVE-2017-5659Apache Traffic Server before 6.2.1 generates a coredump when…
• CVE-2017-5660There is a vulnerability in Apache Traffic Server (ATS) 6.2.…
• CVE-2017-5662In Apache Batik before 1.9, files lying on the filesystem of…
• CVE-2017-5663In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0…
• CVE-2017-5664The error page mechanism of the Java Servlet Specification r…
• CVE-2017-5665The splt_cue_export_to_file function in cue.c in libmp3splt …
• CVE-2017-5666The free_options function in options_manager.c in mp3splt 2.…
• CVE-2017-5667The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci…6.5