CVE-2025-8355
XXE leading to SSRF
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 8, 2025
- Updated
- Aug 8, 2025
- Reserved
- Jul 30, 2025
Description
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Xerox |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
FreeFlow CoreXerox |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.