An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 might lead to access sensitive system information and execute arbitrary commands via supplying a crafted .tmx file.
To exploit this vulnerability, an authenticated attacker has to craft a .tmx file containing the malicious payload with the path to the existing system file or directory. After uploading the file with malicious content, the target server will respond with the specified system folder or file content in the warning message.
Discovered by Nikita Hrab, July 2024
References: https://www.trados.com/product/worldserver/