CVE-2023-24189: Bstek Urule

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.

Affected products

• Bstek Urule: version 2.1.7 only

Published 2023-02-24. Last modified 2026-06-17.