CVE-2020-26831

CVE-2020-26831 is a critical XML external entity (XXE) vulnerability affecting SAP BusinessObjects BI Platform (Crystal Report) versions 4.1, 4.2, and 4.3. The flaw stems from insufficient validation of uploaded XML entities during crystal report generation, allowing attackers with basic privileges to inject arbitrary XML. This can lead to severe impacts including internal file and directory disclosure, Server-Side Request Forgery (SSRF), and denial-of-service (DoS). With a CVSS score of 9.6 (Critical) and a FAUCET Risk Score of 92/100, the vulnerability is easily exploitable over the network with low privileges and complexity, resulting in high confidentiality and availability impacts. While there is no known active exploitation or public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion with 11 mentions and media coverage, indicating awareness among security researchers.