Security Vulnerabilities in Xerox FreeFlow Core enable Server-Side Request Forgery and remote code execution
Take action: If you're running Xerox FreeFlow Core version 8.0.4, make sure it's isolated and accessible only from trusted network. Then plan an update to version 8.0.5, or filter all requests using web application firewall.
Learn More
Xerox Corporation has released a security update to patch two vulnerabilities in its FreeFlow Core document processing software that could enable attackers to perform server-side request forgery attacks and execute remote code on affected systems.
Xerox FreeFlow Core is an enterprise document processing and workflow management software that automates print production, document routing, and digital publishing tasks in corporate environments.
- CVE-2025-8356 (CVSS score 9.8): Path Traversal vulnerability leading to Remote Code Execution (RCE) The vulnerability enables attackers to access files and directories outside the intended application scope by manipulating file paths using special character sequences like "../". It vulnerability allows attackers to traverse the filesystem and access sensitive system files, configuration data, and potentially upload malicious files to arbitrary locations on the server.
- CVE-2025-8355 (CVSS score 7.5): XML External Entity (XXE) processing flaw leading to Server-Side Request Forgery (SSRF). The vulnerability occurs when the application processes XML input containing references to external entities without proper validation or sanitization controls. Attackers can exploit this weakness by crafting malicious XML documents that manipulate entity declarations, forcing the server to make unintended requests to internal or external resources on behalf of the attacker.
The flaw affects FreeFlow Core version 8.0.4. The XXE vulnerability can be used for reconnaissance and initial access, while the path traversal flaw provides the ability for code execution and system compromise.
Xerox has released FreeFlow Core version 8.0.5 to patch both vulnerabilities. Organizations are advised to upgrade their FreeFlow Core.
Organizations unable to update should restrict network access to FreeFlow Core instances to authorized users only and filter out dangerous requests using web application firewall systems.
