Description
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xerox | FreeFlow Core | < 8.0.5 | 8.0.5 |
Advisories 1
- NCSC-2025-0262 Kwetsbaarheden verholpen in Xerox FreeFlow Core NCSC-NL (Netherlands) · Aug 14, 2025