Multiple XXE vulnerabilities in OBS

OBS has a vulnerability that lets attackers insert malicious XML code to read sensitive files from the server. This information can then be used to gain admin access to the OBS system.

XML External Entity (XXE) injection vulnerability in OBS allows remote attackers to reference external entities in XML processing operations, enabling arbitrary file disclosure. Exploitation requires the ability to submit specially crafted XML input to vulnerable endpoints; successful exploitation may lead to information disclosure that facilitates privilege escalation to administrator level.