Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N C N H N 6.8 .8239 99.7 —
AFFECTED Product Versions Fixed xstream < 1.4.15 – —
TIMELINE Oct 1 Reserved by GitHub_M Dec 16 Published (CNA: GitHub_M) Oct 7 EXPLOIT PUBLISHED — CVE-2020-26259 (x-stream xstream). Public exploit reference added.
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
| Date | Event | Detail |
|---|---|---|
| October 1, 2020 | Reserved | Reserved by GitHub_M |
| December 16, 2020 | Published | Published (CNA: GitHub_M) |
| October 7, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2020-26259 (x-stream xstream). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| x-stream | xstream | — | < 1.4.15 | — |
Authoritative record: CVE-2020-26259 at cve.org
Vendors: x-stream
Weaknesses: CWE-78
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-26259 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
