PT-2026-3620 · Opensagres · Xdocreport

Published 2026-01-20 · Updated 2026-02-03 · CVE-2025-64087

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions opensagres XDocReport versions 1.0.0 through 2.1.0

Description A Server-Side Template Injection (SSTI) flaw exists in the FreeMarker component. This allows attackers to execute arbitrary code by injecting crafted template expressions. The affected component is used in opensagres XDocReport.

Recommendations Update opensagres XDocReport to a version later than 2.1.0.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-64087

GHSA-R8W2-W357-9PJV

Affected Products

Xdocreport

References · 14

• 🔥 https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI- · Exploit
• https://osv.dev/vulnerability/CVE-2025-64087 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r8w2-w357-9pjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64087 · Security Note
• https://github.com/opensagres/xdocreport/pull/705 · Note
• https://github.com/opensagres/xdocreport · Note
• https://github.com/opensagres/xdocreport/commit/3b35d105e5ae2006bcaa2b07563188efc466711d · Note
• https://twitter.com/pulsepatchio/status/2014348424825507935 · Twitter Post
• https://t.me/cveNotify/150793 · Telegram Post
• https://twitter.com/TheHackerWire/status/2014008225050587483 · Twitter Post
• https://hackmd.io/@cuongnh/SkQvhEf0lx · Note
• https://twitter.com/CVEnew/status/2013641583208321226 · Twitter Post
• https://hackmd.io/@cuongnh/BJEnw7SAlg · Note
• https://t.me/cveNotify/149401 · Telegram Post