An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14940
Reference (s):
- https://logicaltrust.net/blog/2020/06/tuxguitar.html
- https://sourceforge.net/p/tuxguitar/bugs/126/