CVE-2018-19244: Charlesproxy Charles

High severity, CVSS 8.6. EPSS: 2% chance of exploitation in the next 30 days.

An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked.

Affected products

• Charlesproxy Charles: version 4.2.7 only

Published 2018-11-13. Last modified 2026-06-17.