CVE-2025-8355 HIGH

CVE-2025-8355: XXE leading to SSRF

Vendor Xerox

Product FreeFlow Core

Weakness CWE-611 · XXE

Published August 8, 2025

Last update August 8, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Key dates

02Disclosure timeline

August 8, 2025 CVE published

August 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-8355 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/611.html

Related vulnerabilities

04Related CVE

CVE-2022-43570 XML External Entity Injection through a custom View in Splunk Enterprise CVE-2019-18943 XML External Entity processing CVE-2025-48882 PHPOffice Math allows XXE when processing an XML file in the MathML format CVE-2022-0861 ePO XML extended entity vulnerability CVE-2020-36640 bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference