CVE catalog

CVE-2018-1000069

freeplane: CVE-2018-1000069

Severity: Medium
Published: Mar 13, 2018, 3:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.60% · Oct 25, 2026

FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	freeplane	sid	`1.7.10-3`	fixed
Debian	freeplane	bookworm	`1.7.10-1`	fixed
Ubuntu	freeplane	16.04	`1.3.15-2`	vulnerable
Ubuntu	freeplane	16.04	`1.3.15-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	freeplane	source	sid	`1.6.6-1`	not yet assigned	Not reported	[893663]
Debian	freeplane	source	bookworm	`1.6.6-1`	not yet assigned	Not reported	[893663]

[Debian bug #893663]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[freeplane]Fixed
Details (2)
- 1.7.10-1 · all · bookworm
  Fixed · Fixed: 1.6.6-1
  dsa · freeplane · debian · bookworm; dsa · freeplane · debian · 12
- 1.7.10-1 · all · bookworm
  Fixed · Fixed: 1.6.6-1
  dsa · freeplane · debian · bookworm; dsa · freeplane · debian · 12
[freeplane-scripting-api]Fixed
Source package: [freeplane]
Details (2)
- 1.7.10-1 · all · bookworm
  Fixed · Fixed: 1.6.6-1
  dsa · freeplane · debian · bookworm; dsa · freeplane · debian · 12
- 1.7.10-1 · all · bookworm
  Fixed · Fixed: 1.6.6-1
  dsa · freeplane · debian · bookworm; dsa · freeplane · debian · 12

Observed: Oct 23, 2026, 5:32:19 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]