XXE Injection in Datavane TIS Workflow Editor

Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Datavane TIS v5.0.0 contains a critical XML external entity (XXE) injection vulnerability in its workflow editing functionality that allows authenticated attackers to read arbitrary files and perform server-side request forgery attacks. The vulnerability exists because the doEditWorkflow endpoint processes user-supplied XML through a DocumentBuilderFactory with external entities and DTD loading enabled, failing to sanitize or restrict entity resolution. Organizations running Datavane TIS are affected, particularly those where authenticated users have access to workflow editing capabilities. This vulnerability is especially dangerous because XXE attacks can lead to complete information disclosure, allowing attackers to exfiltrate sensitive configuration files, credentials, and application data without leaving obvious traces.

Casky's 322 mapped skills leverage Claude AI with extended reasoning to identify XXE attack patterns across TA0001 (Reconnaissance) and TA0043 (Reconnaissance) MITRE techniques. Practitioners using the platform would see detections highlighting suspicious XML payloads submitted to the edit_workflow action containing external DTD references, DOCTYPE declarations with SYSTEM identifiers, and parameter entity definitions—all signatures of XXE exploitation attempts. The AI-driven analysis connects these indicators to CWE-611 patterns, flagging requests that attempt to resolve external entities pointing to file:// URIs, internal network addresses, or out-of-band exfiltration channels. By correlating authentication logs with malicious XML submissions to workflow endpoints, practitioners gain visibility into both the attack vector and the attacker's reconnaissance activities, enabling faster incident response and threat hunting across their Datavane deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-69101.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-69101

Casky has 322 skills that investigate the attack patterns behind CVE-2026-69101. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn