CVE-2025-8355

XXE leading to SSRF

High7.5EPSS 9.1%

Published: 8 Aug 2025
Updated: 8 Aug 2025
Reserved: 30 Jul 2025
Assigned by: Xerox

Description

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Scores

CVSS scores of CVE-2025-8355, by who scored it
Scored by	CVSS	Score	Vector
XeroxCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Analyzed	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS (exploitation in 30 days): 9.1% · top 4.7% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-611 Improper Restriction of XML External Entity Reference (opens in a new tab)All about CWE-611 and its CVEs

Affected products

Xerox · FreeFlow Core
- affected < 8.0.5

References (1)

https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-8355](https://trackcve.app/badge/CVE-2025-8355.svg)](https://trackcve.app/cve/CVE-2025-8355)

Record last updated 8 Aug 2025, 16:02 UTC.