PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior version 6.7.2, in certain places, powsybl-core XML parsing vulnerable an external entity (XXE) attack and server-side request forgery (SSRF) attack. This allows attacker elevate their privileges read files that they do not have permissions to, including sensitive on the system. The class com.powsybl.commons.xml.XmlReader which considered be untrusted use cases where users can submit methods. multi-tenant application hosts many different perhaps with privilege levels. issue has been patched com.powsybl:powsybl-commons: 6.7.2.