Home

Description

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

PUBLISHED Reserved 2025-07-30 | Published 2025-08-08 | Updated 2026-02-26 | Assigner Xerox




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Default status
affected

Any version before 8.0.5
affected

References

horizon3.ai/...attack-blogs/from-support-ticket-to-zero-day/ exploit

securitydocs.business.xerox.com/...r-Freeflow-Core-8.0.5.pdf

cve.org (CVE-2025-8356)

nvd.nist.gov (CVE-2025-8356)

Download JSON