CVE-2025-8355

7.5 highEPSS 9.1%

High (7.5) in xerox freeflow core. EPSS 9.1% chance of exploitation in the next 30 days.

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 9.1% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2025-08-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xerox:freeflow_core

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf

Check your stack JSON