CVE-2019-9757: Labkey Server

High severity, CVSS 7.5. EPSS: 37.3% chance of exploitation in the next 30 days.

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.

Affected products

• Labkey Labkey Server: version 19.1.0 only

Published 2019-10-29. Last modified 2026-06-17.