CVE-2025-8356: xerox freeflow_core Path Traversal
CVSS: 9.8v3.1CriticalModified
Published 08-08-2025Last modified 26-02-2026
Vulnerability summary
CVE-2025-8356 is a critical (CVSS 9.8) Path Traversal vulnerability in xerox freeflow_core. EPSS estimates a 19.06% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
19.06%
0%100%
Medium · +1.35 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 08-08-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
19.06%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
+1.35 pp
From 17.71% on 21-09-2026
21-09-202621-10-2026
EPSS score19.06%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (horizon3.ai)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Xerox1 product
- freeflow_core< 8.0.5 | 8.0.4
1 vendor · 1 product
References
2 links- securitydocs.business.xerox.com/wp-content/…Vendor Advisory