PT-2026-22314 · Xerox · Xerox Freeflow Core

CVE-2026-2251 · Publicado 2026-02-27 · Atualizado 2026-03-04

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox FreeFlow Core versions prior to 8.1.0

Description The software contains a path traversal issue due to improper limitation of a pathname to a restricted directory. This allows unauthorized path traversal, potentially leading to remote code execution (RCE). The issue affects file path inputs where insufficient validation or sanitization allows manipulation to access restricted directories on the server.

Recommendations Upgrade to Xerox FreeFlow Core version 8.1.0.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-2251

Produtos afetados

Xerox Freeflow Core

Referências · 11

• https://twitter.com/AIengineerlife/status/2027400361947140337 · Publicação no Twitter
• https://twitter.com/cracbot/status/2029150012433940770 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2027322991684808956 · Publicação no Twitter
• https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-2251 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2027318155622695304 · Publicação no Twitter
• https://t.me/CVEtracker/45948 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2251 · Nota de Segurança
• https://twitter.com/CveTodo/status/2027314984967954766 · Publicação no Twitter
• https://twitter.com/offseq/status/2027307787198321086 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027380177173438635 · Publicação no Twitter