CVE-2025-54254
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-05

Last updated on: 2025-10-02

Assigner: Adobe Systems Incorporated

Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Affected Vendors & Products
Vendor Product Version
adobe experience_manager_forms to 6.5.23.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :

An attacker exploiting this vulnerability could access sensitive files on the local file system, potentially exposing confidential information. Since no user interaction is required, the attack can be performed remotely and silently, increasing the risk of data exposure.


Can you explain this vulnerability to me?

This vulnerability is an Improper Restriction of XML External Entity Reference (XXE) in Adobe Experience Manager versions 6.5.23 and earlier. It allows an attacker to exploit the system to read arbitrary files on the local file system without requiring any user interaction.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart
Meta Information
CVE Publication Date:
2025-08-05
CVE Last Modified Date:
2025-10-02
Report Generation Date:
2026-04-01
AI Powered Q&A Generation:
2025-08-05
EPSS Last Evaluated Date:
2026-03-31
NVD Report Link:
EUVD Report Link: