CVE-2025-8355

—

CVSS 3.1

7.5 high

EPSS

7%p94

Published

Aug 8, 2025 (Aug 8, 2025)

Modified

Jun 17, 2026

Description

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Vendors: xerox
Products: freeflow core
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (7.3%)

In the news3 stories

⚡ Weekly Recap: NFC Fraud, Curly COMrades, N

The Hacker NewsNov 20, 10:46 UTC · Nov 20, 2025Phishing & fraud in the wildCVE-2025-8875 CVE-2025-8876 CVE-2025-26633+36 CVEs

Xerox fixed path traversal and XXE bugs in FreeFlow Core

Security AffairsAug 18, 07:08 UTC · Aug 18, 2025Vulnerability CVE-2025-8355 CVE-2025-8356

Zoom and Xerox Release Critical Security Updates Fixing Privilege Escalation and RCE Flaws

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2025Vulnerability CVE-2025-49457 CVE-2025-8355 CVE-2025-8356