CVE-2026-2252CWE-611CWE-918

XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)

High · published February 27, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.

This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.

Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -  https://www.support.xerox.com/en-us/product/core/downloads

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 18.9th percentile
Weaknesses
CWE-611 · Improper Restriction of XML External Entity Reference; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-27T08:18Z
EPSS history
Timeline
  • 27 FEB 08:18Z
    XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)
    cvelistv5