CVEvulnerability

CVE-2026-2252

7.5 HIGH Published 2026-02-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-27
Last modified
2026-06-17
Assigner
10b61619-3869-496c-8a1e-f291b0e71e3f
CVSS 3.1 (10b61619-3869-496c-8a1e-f291b0e71e3f)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611, CWE-918

Description

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.  Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -  https://www.support.xerox.com/en-us/product/core/downloads

Affected configurations

• xerox freeflow core (< 8.1.0)

Related

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-918 Server-Side Request Forgery weakness

References