CVE-2026-14304

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html	Vendor Advisory
https://github.com/eclipse-actf/org.eclipse.actf	Product
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151	Vendor Advisory
https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eclipse:accessibility_tools_framework::::::::
	cpe:2.3:a:soumu:michecker::::::::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Eclipse Accessibility Tools Framework (ACTF) hasta la 1.6.0 (incluyendo las versiones de código fuente hasta la v20260630 y las versiones de la aplicación miChecker basada en ACTF hasta la 3.1.0), se ha identificado que existe una vulnerabilidad de Entidad Externa XML (XXE). Si esta vulnerabilidad es explotada, un tercero malintencionado podría obtener acceso a recursos locales o recursos de red internos a través de computadoras que ejecutan aplicaciones que utilizan Eclipse ACTF, incluyendo miChecker.

Information

Published : 2026-08-05 11:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-14304

Mitre link : CVE-2026-14304

CVE.ORG link : CVE-2026-14304

JSON object : View

Products Affected

soumu

michecker

eclipse

accessibility_tools_framework

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-14304", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14304", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:03:48.752239Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Accessibility Tools Framework (ACTF)", "versions": [{"status": "affected", "version": "0.5.0", "versionType": "semver", "lessThanOrEqual": "1.6.0"}, {"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "v20260630"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T11:16:24.887", "references": [{"url": "https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://github.com/eclipse-actf/org.eclipse.actf", "tags": ["Product"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/", "tags": ["Product"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.\n\n\n\nIf this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker."}, {"lang": "es", "value": "En las versiones de Eclipse Accessibility Tools Framework (ACTF) hasta la 1.6.0 (incluyendo las versiones de c\u00f3digo fuente hasta la v20260630 y las versiones de la aplicaci\u00f3n miChecker basada en ACTF hasta la 3.1.0), se ha identificado que existe una vulnerabilidad de Entidad Externa XML (XXE).\n\nSi esta vulnerabilidad es explotada, un tercero malintencionado podr\u00eda obtener acceso a recursos locales o recursos de red internos a trav\u00e9s de computadoras que ejecutan aplicaciones que utilizan Eclipse ACTF, incluyendo miChecker."}], "lastModified": "2026-10-23T21:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:accessibility_tools_framework:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "300F91D3-CAAE-4D2A-BA7C-D1C3D4CACD2D", "versionEndIncluding": "1.6.0", "versionStartIncluding": "0.5.0"}, {"criteria": "cpe:2.3:a:soumu:michecker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BAF9066-1B9B-4AF8-9196-FB346310AEB4", "versionEndExcluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}