CVE-2025-8356

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8356
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf Vendor Advisory
https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/
Configurations

Configuration 1 (hide)

cpe:2.3:a:xerox:freeflow_core:8.0.4:*:*:*:*:*:*:*
History

18 Aug 2025, 18:15

Type Values Removed Values Added
References
  • () https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/ -

14 Aug 2025, 16:19

Type Values Removed Values Added
CPE cpe:2.3:a:xerox:freeflow_core:8.0.4:*:*:*:*:*:*:*
References () https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf - () https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf - Vendor Advisory
First Time Xerox freeflow Core
Xerox
Summary
  • (es) En la versión 8.0.4 de Xerox FreeFlow Core, un atacante puede explotar una vulnerabilidad de Path Traversal para acceder a archivos no autorizados en el servidor. Esto puede provocar la ejecución remota de código (RCE), lo que permite al atacante ejecutar comandos arbitrarios en el sistema.

08 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-08 16:15

Updated : 2025-08-18 18:15

NVD link : CVE-2025-8356

Mitre link : CVE-2025-8356

CVE.ORG link : CVE-2025-8356

JSON object : View

Products Affected

xerox

  • freeflow_core
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-94

Improper Control of Generation of Code ('Code Injection')