Gucralp - XXE (CVE-2022-38840)

CVE-2022-38840 is an XML External Entity (XXE) vulnerability in the cgi-bin/xmlstatus.cgi component of Gucralp MAN-EAM-0003 version 3.2.4, which allows remote attackers to upload malicious XML files and access sensitive local files on the server. This flaw could be exploited to disclose confidential information, posing a significant risk to data security.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec network observations suggest that most exploitation of CVE-2022-38840 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec network telemetry also shows that exploitation of CVE-2022-38840 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /cgi-bin/xmlstatus.cgi endpoint by uploading specially crafted XML files containing external entity references, enabling them to read sensitive files from the server via XML External Entity (XXE) injection.