PatchTheCVECVE-2009-5135: The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files
CVE-2009-5135 is a medium-severity flaw (CVSS 5.0) affecting echo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Why this priority
- EPSS top 4%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| EPSS exploit chance | 9.9% (top 4%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2013-05-02 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: NextApp Echo < 2.1.1 - XML Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2009-5135?
echo: upgrade to newer than 2.1.0. Exact commands for each OS are on this page.
Is CVE-2009-5135 being exploited?
CVE-2009-5135 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2009-5135 affect?
CVE-2009-5135 affects echo. Severity is medium (CVSS 5.0). The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entit
How urgent is CVE-2009-5135?
Priority 46/100. EPSS top 4%: very likely to be exploited; Public exploit reference
Software pages
Related CVEs
- CVE-2025-51741 HIGH 7.5 DOWNGRADE An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated a
- CVE-2022-40083 CRITICAL 9.6 DOWNGRADE Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component
- CVE-2020-36565 MEDIUM 5.3 UPGRADE Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal,
- CVE-2015-8007 MEDIUM 4.0 MITIGATE The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote au