CVE-2026-73235 FreeCAD CVE debrief

Who should care

Defenders and users of FreeCAD, especially those using versions prior to 1.1.2, should assess their exposure to this vulnerability and prioritize upgrading to the fixed version. Affected operators, platforms, and security teams should review the official advisory and verify if their inventory is affected. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-73235 is a vulnerability in FreeCAD that allows for potential local file reads or server-side requests through crafted .FCStd archives. Defenders should prioritize assessing exposure, verifying inventory, and upgrading to version 1.1.2 or later.

• Potential local file reads through crafted .FCStd archives
• Potential server-side requests through crafted .FCStd archives
• Verification of FreeCAD version and inventory exposure
• Prioritization of upgrades to version 1.1.2 or later

Technical summary

The Xerces SAX2 XMLReader in FreeCAD's src/Base/Reader.cpp parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. This issue allows for potential local file reads or server-side requests when the document is opened. The vulnerability affects FreeCAD versions prior to 1.1.2, and defenders should prioritize assessing exposure and verifying inventory. The issue is fixed in version 1.1.2, and users should upgrade to the fixed version.

Defensive priority

Defenders should prioritize assessing exposure to this vulnerability, especially those using FreeCAD versions prior to 1.1.2, and verify if their inventory is affected.

Recommended defensive actions

• Assess exposure to this vulnerability, especially for those using FreeCAD versions prior to 1.1.2
• Verify if your inventory is affected and prioritize upgrading to version 1.1.2 or later
• Monitor for potential local file reads or server-side requests through crafted .FCStd archives
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. The issue is fixed in FreeCAD version 1.1.2. Defenders should verify if their inventory is affected and review the official advisory for guidance. The vulnerability allows for potential local file reads or server-side requests through crafted .FCStd archives. Evidence from the CVE Program and NVD detail page supports this assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.