CVE-2025-8355CWE-611

XXE leading to SSRF

High · published August 8, 2025

CVSS v3.1
7.5
EPSS
9%
Percentile
95.2
In the wild
Unconfirmed
What it is

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.08809 · 95.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-08-08T15:31Z
EPSS history
Timeline
  • 08 AUG 15:31Z
    XXE leading to SSRF
    cvelistv5