Sentinel update: XXE file exfiltration fixed in FTK Imager
A crafted UFDR archive could make FTK Imager send files from the examiner's workstation to an attacker. Exterro fixed it in FTK Imager 8.3.
Mobasi Research
This Sentinel update covers an Exterro FTK Imager vulnerability that became public on September 3, 2026. VulnCheck published it as CVE-2026-82525.
FTK Imager
Examiners use FTK Imager to preview evidence and make forensic images. They often open evidence that comes from other parties, so a file that attacks the examiner's tool is a realistic risk.
XXE File Exfiltration via Report.xml XSLT
high- Issue
- FTK Imager processed the
Report.xmlfile in a UFDR evidence archive with external entities and external XSLT stylesheets enabled. A craftedReport.xmlcan refer to local files throughfile://entities and load an attacker-controlled stylesheet that runsmsxsl:script. - Impact
- When an examiner previews a malicious UFDR archive, FTK Imager reads files from the examiner's workstation and sends their contents to an attacker-controlled server through a generated image URL.
- Advisory
- VulnCheck
Exterro fixed the issue in FTK Imager 8.3. Update to 8.3 or later.
Current Sentinel index
The Sentinel page remains the running public index of disclosed vulnerabilities and remediation status across our reviews.