CVE-2025-8355: XXE leading to SSRF
Published Aug 8, 2025
·Updated
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
Affected Software
2 affected components
Xerox FreeFlow Core
Xerox FreeFlow Core=8.0.4
Event History
Aug 8, 2025
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Mar 7, 57592
Event
via FIRST·11:32 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-8355?
CVE-2025-8355 is rated as a critical vulnerability due to its potential for exploitation resulting in Server-Side Request Forgery.
2
How do I fix CVE-2025-8355?
To mitigate CVE-2025-8355, update Xerox FreeFlow Core to version 8.0.5 or later.
3
What is the impact of CVE-2025-8355?
CVE-2025-8355 can lead to unauthorized access to internal URLs by exploiting improper handling of XML input.
4
Which versions of Xerox FreeFlow Core are affected by CVE-2025-8355?
CVE-2025-8355 affects Xerox FreeFlow Core version 8.0.4 and earlier.
5
How does CVE-2025-8355 exploit Server-Side Request Forgery?
CVE-2025-8355 allows an attacker to inject malicious XML that references internal URLs, enabling SSRF.