OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit …

OpenRemote, an open-source IoT platform, contains an XML External Entity (XXE) vulnerability in its Velbus asset import functionality prior to version 1.22.0. The vulnerability allows authenticated users to exploit XML parsing without proper XXE hardening, potentially leading to server-side file disclosure and Server-Side Request Forgery (SSRF) attacks. The exploitation is limited to files under 1023 characters. Version 1.22.0 addresses this security issue.