CVE-2026-2251CWE-22

Path Traversal leading to Remote Code Execution (RCE)

Critical · published February 27, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE.

This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.

Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

https://www.support.xerox.com/en-us/product/core/downloads

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-27T08:08Z
EPSS history
Timeline
  • 27 FEB 08:08Z
    Path Traversal leading to Remote Code Execution (RCE)
    cvelistv5