XXE in Jaspersoft Jasperreports Server
CVE-2026-16626
Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.
Vulnerability class: XXE (XML External Entity)
Affected products
- Jaspersoft Jasperreports Server — versions 9.0.0, 10.0.0