CVE-2009-5135: The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary fi...

Security readout for executives and security teams

This flaw affects older NextApp Echo versions and can let a remote attacker make the application’s XML parser read local files from the server. Business risk depends on whether Echo is still used in reachable applications, but successful abuse could expose secrets, configuration, or sensitive data. Exposure is likely limited to legacy Java applications using NextApp Echo versions before 2.1.1 or Echo 3.x before 3.0.b6, especially where attacker-controlled XML reaches Echo parsing logic over a network-accessible route. Prioritize remediation for internet-facing or partner-facing Java applications using affected Echo versions. The main business concern is server-side file disclosure, including credentials or configuration files, not confirmed active exploitation from the supplied evidence. Mitigation focus: Inventory applications for Echo before 2.1.1 and Echo 3.x before 3.0.b6.; Upgrade affected Echo deployments to fixed vendor versions where supported.; Remove or isolate obsolete Echo components if upgrades are not practical..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.