PT-2026-22315 · Xerox · Xerox Freeflow Core

CVE-2026-2252 · Publicado 2026-02-27 · Atualizado 2026-03-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xerox FreeFlow Core versions up to and including 8.0.7

Description An XML External Entity (XXE) issue allows a malicious user to perform Server-Side Request Forgery (SSRF) by submitting specially crafted XML input that includes malicious external entity references. This allows an attacker to potentially make requests to internal or external resources on behalf of the server.

Recommendations Upgrade to Xerox FreeFlow Core version 8.1.0.

Correção

XXE

SSRF

Enumeração de Fraquezas

CWE-611

CWE-918

Identificadores relacionados

CVE-2026-2252

Produtos afetados

Xerox Freeflow Core

Referências · 6

• https://osv.dev/vulnerability/CVE-2026-2252 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027380175051083963 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2252 · Nota de Segurança
• https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf · Aviso do Fabricante
• https://t.me/CVEtracker/45958 · Publicação no Telegram
• https://twitter.com/cracbot/status/2029150014078128534 · Publicação no Twitter