CVE-2025-8356

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8356
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf Vendor Advisory
https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/
Configurations

Configuration 1 (hide)

cpe:2.3:a:xerox:freeflow_core:8.0.4:*:*:*:*:*:*:*
History

18 Aug 2025, 18:15

Type Values Removed Values Added
References
  • () https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/ -

14 Aug 2025, 16:19

Type Values Removed Values Added
Summary
  • (es) En la versión 8.0.4 de Xerox FreeFlow Core, un atacante puede explotar una vulnerabilidad de Path Traversal para acceder a archivos no autorizados en el servidor. Esto puede provocar la ejecución remota de código (RCE), lo que permite al atacante ejecutar comandos arbitrarios en el sistema.
First Time Xerox freeflow Core
Xerox
CPE cpe:2.3:a:xerox:freeflow_core:8.0.4:*:*:*:*:*:*:*
References () https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf - () https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf - Vendor Advisory

08 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-08 16:15

Updated : 2025-08-18 18:15

NVD link : CVE-2025-8356

Mitre link : CVE-2025-8356

CVE.ORG link : CVE-2025-8356

JSON object : View

Products Affected

xerox

  • freeflow_core
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-94

Improper Control of Generation of Code ('Code Injection')