CVE-2021-39371: Debian Linux

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

Affected products

• Debian Debian Linux: version 9.0 only
• OSGeo Owslib: version 0.24.1 only
• OSGeo Pywps: before 4.4.5 (fixed in 4.4.5)

Published 2021-08-23. Last modified 2026-06-17.