CVE-2026-2252
XXE Vulnerability in Xerox FreeFlow Core Enables SSRF Attack
Publication date: 2026-02-27
Last updated on: 2026-03-02
Assigner: Xerox
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xerox | freeflow_core | to 8.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an XML External Entity (XXE) issue that allows a malicious user to perform Server-Side Request Forgery (SSRF). It occurs when crafted XML input containing malicious external entity references is processed by the affected software.
Specifically, the vulnerability affects Xerox FreeFlow Core versions up to and including 8.0.7.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform SSRF attacks by exploiting the XXE flaw. This means an attacker could potentially make unauthorized requests from the server, which could lead to exposure of sensitive information or interaction with internal systems.
According to the CVSS score (7.5), the impact on confidentiality is high, but there is no impact on integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Xerox FreeFlow Core to version 8.1.0 or later.
This upgrade addresses the XML External Entity (XXE) vulnerability that allows Server-Side Request Forgery (SSRF) via crafted XML input.
The updated software can be downloaded from the official Xerox support site at https://www.support.xerox.com/en-us/product/core/downloads.