CVE-2023-35815 is a low severity flaw (CVSS 3.5) in DevExpress. A data source protection mechanism can be bypassed during deserialization of XML data. The record lists versions before 23.1.3 as affected. Update to 23.1.3, or to the fixed release for your older branch.
What's affected
The CVE record says DevExpress before 23.1.3 is affected. Code White's public list shows the data source protection bypass during XML deserialization with fixed releases by branch: 23.1.3, 22.2.6, 22.2.3, 22.1.9, 22.1.7 and 21.2.12.
DevExpress support centre tickets describe the web reporting variant as a protection that could be bypassed when reading XML. Check the vendor advisory for the exact products, since the DevExpress library covers desktop, web and reporting components.
How to check if you're exposed
In a .NET project, list the DevExpress packages and compare them with the fixed releases:
dotnet list package | grep -i devexpress
For Web Forms and older solutions, read the version of the DevExpress assemblies in the bin directory of the deployed site. A version below the fixed release of your branch is in range.
Then note where XML data sources are used. Reports that load definitions or data from files or users deserve the closest look. If your app only uses reports you ship yourself, the exposure is smaller.
What to do now
- Inventory DevExpress versions across your applications.
- Update to 23.1.3 or the fixed release in your branch and rebuild.
- Apply any configuration changes that the DevExpress advisory recommends.
- Treat report definitions from outside your team as untrusted until the update is in place.
Why it matters
The class is deserialization of untrusted data (CWE-502). A protection mechanism exists to stop unsafe types or sources from being loaded when XML is turned back into objects, and the flaw lets an attacker get around it. Protection that can be bypassed gives a false sense of safety, which is why these fixes matter even when the score is low.
The score is 3.5 because the record requires high attack complexity and some privileges, with a limited integrity effect. It was published alongside CVE-2023-35814 and CVE-2023-35817, and one upgrade covers all three. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not describe attacks in the wild.
Quick check
Do the three DevExpress CVEs need three upgrades?
No. They were fixed in the same releases, so a single update to 23.1.3 or your branch's fixed release covers them.
Does this affect desktop apps?
The record is about deserialization in the DevExpress library. Check the vendor advisory for the product list that applies to your build.
Sources
Last reviewed: 19 October 2026.
