CVE-2025-8355 — XXE leading to SSRF

CVE-2025-8355

XXE leading to SSRF PUBLISHED

Description (CNA)

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Affected (CNA)

Vendor / product	Versions
Xerox / FreeFlow Core	affected 0 before 8.0.5

CWE

CWE-611

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.